17c07801ef59676f056659dea9953b977b2950d02f48bbc4160ea748a71426aa

Analysis

Target

907a9dfa1ee12bc85669faaf78bbcea4.bat
Size

214B
MD5

e1fe18d046cfe61c5f33836a8a3f7787
SHA1

ac46f9af46ba6f847df4627fbfbff3e4f7641305
SHA256

17c07801ef59676f056659dea9953b977b2950d02f48bbc4160ea748a71426aa
SHA512

1799090232c52da264281d4117b1f76262d752469de2ded0db8176acde4af6c31ba7fe37bfe0339075506884e11e564726d197e27bfeb9df1d7a27487500a9d2

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/907a9dfa1ee12bc85669faaf78bbcea4

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1040 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1040 powershell.exe
1040 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1040 powershell.exe

flow	pid	process
4	1040	powershell.exe

pid	process
1040	powershell.exe

pid	process
1040	powershell.exe
1040	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1408 wrote to memory of 1040	1408	cmd.exe	powershell.exe
PID 1408 wrote to memory of 1040	1408	cmd.exe	powershell.exe
PID 1408 wrote to memory of 1040	1408	cmd.exe	powershell.exe
PID 1408 wrote to memory of 1040	1408	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\907a9dfa1ee12bc85669faaf78bbcea4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408

memory/1040-0-0x0000000000000000-mapping.dmp

Download
memory/1040-1-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/1040-2-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1040-3-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/1040-4-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1040-5-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/1040-8-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/1040-13-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/1040-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1040-21-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/1040-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download