bdb3f36c480f19ec8d2aa9a181d0f606f53586ba44e2065be4b5a94cc4460913

Analysis

Target

484333e52a633dd4ddba453c88728166.bat
Size

220B
MD5

78a20a9e11dcafee6975c27337f224f6
SHA1

bf2f2d540d8c622f2c35950b2517e06bd1ffa085
SHA256

bdb3f36c480f19ec8d2aa9a181d0f606f53586ba44e2065be4b5a94cc4460913
SHA512

206fdef2f70c68a78c5a261d15e795faf814384a3124f9dc149ce215eb15e9b2fb7dea1aef79183228a5af6d014bd3dc6cacaaab6b9cbeaf81d95475406717ab

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/484333e52a633dd4ddba453c88728166

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1296 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1296 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1296 powershell.exe
1296 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1296 powershell.exe

flow	pid	process
6	1296	powershell.exe

pid	process
1296	powershell.exe

pid	process
1296	powershell.exe
1296	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1296	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1492 wrote to memory of 1296	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 1296	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 1296	1492	cmd.exe	powershell.exe
PID 1492 wrote to memory of 1296	1492	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\484333e52a633dd4ddba453c88728166.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

memory/1296-0-0x0000000000000000-mapping.dmp

Download
memory/1296-1-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1296-2-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/1296-3-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1296-4-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1296-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1296-8-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/1296-13-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/1296-14-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/1296-21-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/1296-22-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download