765c8a1c379b68045e0723ad205edd2ebbdea57c003ec7fb78bb91868ff1d2bd

Analysis

Target

ab140e9cdf481895e1fc3230b74a6163.bat
Size

222B
MD5

2c0b9ea7ff3eb83f39fbefb161432e0a
SHA1

660fc5ebdfc2b59488b46f4b4e05873d697a84e0
SHA256

765c8a1c379b68045e0723ad205edd2ebbdea57c003ec7fb78bb91868ff1d2bd
SHA512

fb4b97e568e0e8204ec9039cbf8f6c808a0f96feca4ff85f2bfec2279e09f3f53a8373035669ee04cc239a10920c2d6864b59ae35eeac04e09384959c36e0577

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/ab140e9cdf481895e1fc3230b74a6163

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 1820 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1820 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1820 powershell.exe
1820 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1820 powershell.exe

flow	pid	process
6	1820	powershell.exe

pid	process
1820	powershell.exe

pid	process
1820	powershell.exe
1820	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1820	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1820	900	cmd.exe	powershell.exe
PID 900 wrote to memory of 1820	900	cmd.exe	powershell.exe
PID 900 wrote to memory of 1820	900	cmd.exe	powershell.exe
PID 900 wrote to memory of 1820	900	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ab140e9cdf481895e1fc3230b74a6163.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:900

memory/1820-0-0x0000000000000000-mapping.dmp

Download
memory/1820-1-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/1820-2-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1820-3-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/1820-4-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1820-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1820-8-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

Filesize
4KB

Download
memory/1820-13-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/1820-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1820-21-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/1820-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download