e7e8cf1b2c56a7d5810b8158b78da915ec54ccaf837e10277a88baf327edac05

Analysis

Target

ee784cf3584e7d556683ef667f8905c7.bat
Size

213B
MD5

f875790db1a23bbb0f99b5d028e3dcdb
SHA1

be6db7752b70a78736535d0b832da469ee3030d2
SHA256

e7e8cf1b2c56a7d5810b8158b78da915ec54ccaf837e10277a88baf327edac05
SHA512

1a301a17acfb97cb522278aa77a3d06efa64338931509ce8a49431d481954a2f209bb5b41a25daae11c59de88eb232f702c5559a9b52f04f20f0aaee0f6b42d7

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/ee784cf3584e7d556683ef667f8905c7

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1040 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
1040 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1040 powershell.exe

flow	pid	process
5	1040	powershell.exe

pid	process
1040	powershell.exe

pid	process
1040	powershell.exe
1040	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1440 wrote to memory of 1040	1440	cmd.exe	powershell.exe
PID 1440 wrote to memory of 1040	1440	cmd.exe	powershell.exe
PID 1440 wrote to memory of 1040	1440	cmd.exe	powershell.exe
PID 1440 wrote to memory of 1040	1440	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ee784cf3584e7d556683ef667f8905c7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

memory/1040-0-0x0000000000000000-mapping.dmp

Download
memory/1040-1-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1040-2-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1040-3-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1040-4-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/1040-5-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/1040-8-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/1040-13-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1040-14-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/1040-21-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/1040-22-0x00000000062F0000-0x00000000062F1000-memory.dmp

Filesize
4KB

Download