25ef88f973e50b6cd72f2dd572618de7302e12a2925429568598205dc85a9585

Analysis

Target

703f05dca6cfaba3626152c6d4d1fcd6.bat
Size

220B
MD5

0a6ac1495b26f97102dc547e02722707
SHA1

a15c39e75f663c0e0ee152ac9c09541ffd6d1221
SHA256

25ef88f973e50b6cd72f2dd572618de7302e12a2925429568598205dc85a9585
SHA512

04b8fffa2dc6bb4b867392c307ae9472849b6872b8fca42568fec4ee07e76d09f41ff16007725b36a86ce3f45fabd6c5f86ac2ff26c71805cd11213bff539c2a

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/703f05dca6cfaba3626152c6d4d1fcd6

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1928 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1928 powershell.exe
1928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1928 powershell.exe

flow	pid	process
6	1928	powershell.exe

pid	process
1928	powershell.exe

pid	process
1928	powershell.exe
1928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1516 wrote to memory of 1928	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1928	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1928	1516	cmd.exe	powershell.exe
PID 1516 wrote to memory of 1928	1516	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\703f05dca6cfaba3626152c6d4d1fcd6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

memory/1928-0-0x0000000000000000-mapping.dmp

Download
memory/1928-1-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/1928-2-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/1928-3-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1928-4-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1928-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1928-8-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/1928-13-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/1928-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1928-21-0x00000000061B0000-0x00000000061B1000-memory.dmp

Filesize
4KB

Download
memory/1928-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download