63c63bb4f93c338d10395291b9b6255eb0d16250de46491f572a20284da5a007

Analysis

Target

57948d7f2e776c683d1bec54a461ce1d.bat
Size

220B
MD5

f639a0fd02a603ce76b6024956fdc25b
SHA1

783590b7e2a89acb69468ac3ece79f3bcf9b6137
SHA256

63c63bb4f93c338d10395291b9b6255eb0d16250de46491f572a20284da5a007
SHA512

7ff6c69a22632f4adc6dae824d095714bebbe45023f7a961c293a0faa472063b8965c183442977ba54453154d02dade43d2d7c3dd2234bf97e27b1422e81e4bb

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/57948d7f2e776c683d1bec54a461ce1d

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1512 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1512 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1512 powershell.exe
1512 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1512 powershell.exe

flow	pid	process
5	1512	powershell.exe

pid	process
1512	powershell.exe

pid	process
1512	powershell.exe
1512	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1512	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 112 wrote to memory of 1512	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1512	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1512	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1512	112	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\57948d7f2e776c683d1bec54a461ce1d.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:112

memory/1512-0-0x0000000000000000-mapping.dmp

Download
memory/1512-1-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/1512-2-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1512-3-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/1512-4-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1512-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1512-8-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/1512-13-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1512-14-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/1512-21-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1512-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download