ebfad7734e6b37d7bf1576bce1883d8f8668cf60a488058efd9b75e598e7076c

Analysis

Target

c378638c5a35bb563b4b36d635451cb9.bat
Size

219B
MD5

8e9d65b141e89c3d651fa89e306b9b0f
SHA1

5e1c4e09823b5c79eb82dc0d3994f7380c6f5d22
SHA256

ebfad7734e6b37d7bf1576bce1883d8f8668cf60a488058efd9b75e598e7076c
SHA512

50d0f6edf1d5a12640d5e826491bc8b6669360b1aae12e7052eab88ecba33c4b87ce39750eb55507276af60ca202dbf726c688d01aad7ce76d7668d26195a834

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/c378638c5a35bb563b4b36d635451cb9

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1496 wrote to memory of 1820	1496	cmd.exe	powershell.exe
PID 1496 wrote to memory of 1820	1496	cmd.exe	powershell.exe
PID 1496 wrote to memory of 1820	1496	cmd.exe	powershell.exe
PID 1496 wrote to memory of 1820	1496	cmd.exe	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1820 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1820 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1820 powershell.exe
1820 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 1820 powershell.exe

pid	process
1820	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1820	powershell.exe

pid	process
1820	powershell.exe
1820	powershell.exe

flow	pid	process
3	1820	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\c378638c5a35bb563b4b36d635451cb9.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496