3efce93dd9105db75b8a9634774a9d39cc0f03c08598237f8ec0958d3d121e0e

Analysis

Target

qeMZ0hsA.bat
Size

198B
MD5

dbdcd0ab61ac04d5a8795b41b1f91646
SHA1

b94545d0a340a837622f2785ce5c108ef9ffebe7
SHA256

3efce93dd9105db75b8a9634774a9d39cc0f03c08598237f8ec0958d3d121e0e
SHA512

a5083ac4ca7232a5c83e4c9337d0b7634394e359772bce80ed0450f7a42e1d43f5dcaccf25a9fcb37b46fcc2948d23e9758d3a39c43985f8ba3fc11bf7bc81b6

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/qeMZ0hsA

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1856 powershell.exe
Suspicious use of WriteProcessMemory 1 IoCs

Processes:

cmd.exe

description pid process target process

PID 1832 wrote to memory of 1856 1832 cmd.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1856 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1856 powershell.exe
1856 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 1856 powershell.exe

pid	process
1856	powershell.exe

description	pid	process	target process
PID 1832 wrote to memory of 1856	1832	cmd.exe	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1856	powershell.exe

pid	process
1856	powershell.exe
1856	powershell.exe

flow	pid	process
3	1856	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\qeMZ0hsA.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832