b64c3249144683345453feac5f2c3ed3374d33a8eaf6bf4e30299e55a1bf1fca

Analysis

Target

d8b4df362b6cf1bf526634ea889b42de.bat
Size

213B
MD5

fa5f98db7255446f6688e03c1b8639e1
SHA1

9149b6cdcab524d9e06254b52dcdcb0455cdb7ac
SHA256

b64c3249144683345453feac5f2c3ed3374d33a8eaf6bf4e30299e55a1bf1fca
SHA512

e13b67fd455c2e28362529b6cc986135be45d21ad68a8a7b7af6203b4766dce4fe74bd1f8fc16f7de6b09f1b9a787982d4302b2aa26c48c5a6326503b6d3d4a8

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/d8b4df362b6cf1bf526634ea889b42de

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1492 wrote to memory of 892	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 892	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 892	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 892	1492	cmd.exe	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

892 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 892 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

892 powershell.exe
892 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 892 powershell.exe

pid	process
892	powershell.exe

description	pid	process
Token: SeDebugPrivilege	892	powershell.exe

pid	process
892	powershell.exe
892	powershell.exe

flow	pid	process
3	892	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\d8b4df362b6cf1bf526634ea889b42de.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492