2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132

Resubmissions

04-08-2020 12:31

26-07-2020 14:10

Target

e241deaf6f1e1d0d13589a66c942bc3b.bat
Size

216B
MD5

c79f7f4fe4b00e41b6dce691ba63a8ae
SHA1

b8f15e882ed45e2278545ad4e686e16cb1787dc3
SHA256

2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132
SHA512

b20d2b133be14683663d795b6c2abf5fb2b23a2b87cc9ddbba1218dbd5d9704d112d13d51e6cb62f18297c8797d2c3152501bc35f1f97af2821c19d201a40034

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/e241deaf6f1e1d0d13589a66c942bc3b

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 608 wrote to memory of 1408	608	cmd.exe	powershell.exe
PID 608 wrote to memory of 1408	608	cmd.exe	powershell.exe
PID 608 wrote to memory of 1408	608	cmd.exe	powershell.exe
PID 608 wrote to memory of 1408	608	cmd.exe	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1408 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1408 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1408 powershell.exe
1408 powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1408 powershell.exe

pid	process
1408	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1408	powershell.exe

pid	process
1408	powershell.exe
1408	powershell.exe

flow	pid	process
4	1408	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\e241deaf6f1e1d0d13589a66c942bc3b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:608