0c2979fbb38e64c1f010da3bf048f308add447789e3490462a4a2914882501bc

Analysis

Target

3ebef916c89bfab6725e5179bc66e52e.bat
Size

220B
MD5

ffba72e711c822550ffada7128fa23c1
SHA1

8e0fecaddf1765771895425d408b902606e17e69
SHA256

0c2979fbb38e64c1f010da3bf048f308add447789e3490462a4a2914882501bc
SHA512

4863cc96608a32708f4843bdb275bedfd88435e55316a38ff22e4fbf7453fd194785a8c9f78efe55e3d3149e9dbdb284517a1d6d4f1bff25ea8abe457be7e1a7

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/3ebef916c89bfab6725e5179bc66e52e

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1516 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1516 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1516 powershell.exe
1516 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1516 powershell.exe

flow	pid	process
4	1516	powershell.exe

pid	process
1516	powershell.exe

pid	process
1516	powershell.exe
1516	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1516	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1436 wrote to memory of 1516	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1516	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1516	1436	cmd.exe	powershell.exe
PID 1436 wrote to memory of 1516	1436	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\3ebef916c89bfab6725e5179bc66e52e.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

memory/1516-0-0x0000000000000000-mapping.dmp

Download
memory/1516-1-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/1516-2-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1516-3-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/1516-4-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/1516-5-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1516-8-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/1516-13-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/1516-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1516-21-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/1516-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download