146be0d88aa964787807ec908e13f1eb124530caca22ad1c3d80c73761892e90

Analysis

Target

cfc86f216b68d4b768a61dc8091a67ab.bat
Size

217B
MD5

89876aac9d3c6644f7ae3b4cf68d7a1e
SHA1

e37353d60d13106478fd94133ec1ae8b15e51062
SHA256

146be0d88aa964787807ec908e13f1eb124530caca22ad1c3d80c73761892e90
SHA512

8ea7a17a997a6b12f0acac1951fe0dc70c57221bd2204173597b951e7bf77b3f1f94a5ded81f074f51cb159d4ebe7bf7db1c207fd4febcfae1183788890ee503

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/cfc86f216b68d4b768a61dc8091a67ab

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1040 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
1040 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1040 powershell.exe

flow	pid	process
5	1040	powershell.exe

pid	process
1040	powershell.exe

pid	process
1040	powershell.exe
1040	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1460 wrote to memory of 1040	1460	cmd.exe	powershell.exe
PID 1460 wrote to memory of 1040	1460	cmd.exe	powershell.exe
PID 1460 wrote to memory of 1040	1460	cmd.exe	powershell.exe
PID 1460 wrote to memory of 1040	1460	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cfc86f216b68d4b768a61dc8091a67ab.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

memory/1040-0-0x0000000000000000-mapping.dmp

Download
memory/1040-1-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1040-2-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/1040-3-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1040-4-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/1040-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1040-8-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/1040-13-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/1040-14-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/1040-21-0x00000000061B0000-0x00000000061B1000-memory.dmp

Filesize
4KB

Download
memory/1040-22-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download