755c35484b2236919e799e05687ca2aff151593f39c9deee51c33f6f33c97c7a

Analysis

Target

9e35cd287a986dd3eab0fd5413dbbfb3.bat
Size

215B
MD5

d14242bd9a927a641dc49bf913b5b570
SHA1

b031b26dd6d89c5672b9cb2f7fe66d650222a687
SHA256

755c35484b2236919e799e05687ca2aff151593f39c9deee51c33f6f33c97c7a
SHA512

ff13f23ffa4f9e0e568b9eb7aacfe9340d72e46dac773d51356b26b5323102c8d016f4c87ff6cb2d3d886961dd335382f37d88f27b6fac7264ae562079780ab0

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/9e35cd287a986dd3eab0fd5413dbbfb3

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1916 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1916 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1916 powershell.exe
1916 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1916 powershell.exe

flow	pid	process
5	1916	powershell.exe

pid	process
1916	powershell.exe

pid	process
1916	powershell.exe
1916	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1916	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1516 wrote to memory of 1916	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1916	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1916	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1916	1516	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\9e35cd287a986dd3eab0fd5413dbbfb3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

memory/1916-0-0x0000000000000000-mapping.dmp

Download
memory/1916-1-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/1916-2-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1916-3-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/1916-4-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1916-5-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1916-8-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/1916-13-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/1916-14-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/1916-21-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/1916-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download