f4dce5d134eceafacb29f6c45d8fb6155a7e5be430516a0df8f91495b8836abf

Analysis

Target

a87639941dd963a944a448c5da3a1d22.bat
Size

216B
MD5

4e24b08cc0bb74713a5fdd1a9b647461
SHA1

7d9b9ccee1269dd27297d2b5000f34d5b2e8231b
SHA256

f4dce5d134eceafacb29f6c45d8fb6155a7e5be430516a0df8f91495b8836abf
SHA512

b582aeb8a2b04d4926849e945d27f1690c361d33a79e4ebaced85532af32153aa8e2b5d040d021eb1f95d435c436501199b8c92005418b5916e077a0fc71f40c

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/a87639941dd963a944a448c5da3a1d22

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1276 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1276 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1276 powershell.exe
1276 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1276 powershell.exe

flow	pid	process
6	1276	powershell.exe

pid	process
1276	powershell.exe

pid	process
1276	powershell.exe
1276	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1276	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1768 wrote to memory of 1276	1768	cmd.exe	powershell.exe
PID 1768 wrote to memory of 1276	1768	cmd.exe	powershell.exe
PID 1768 wrote to memory of 1276	1768	cmd.exe	powershell.exe
PID 1768 wrote to memory of 1276	1768	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\a87639941dd963a944a448c5da3a1d22.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

memory/1276-0-0x0000000000000000-mapping.dmp

Download
memory/1276-1-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/1276-2-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/1276-3-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1276-4-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1276-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1276-8-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/1276-13-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1276-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1276-21-0x00000000061B0000-0x00000000061B1000-memory.dmp

Filesize
4KB

Download
memory/1276-22-0x0000000006320000-0x0000000006321000-memory.dmp

Filesize
4KB

Download