3f89ce5be773c28644ec626cd94037a02958f69cb9a571c6c69788af498e06c4

Analysis

Target

87f461a62a7de4013da81005cdc4ac08.bat
Size

213B
MD5

b80441d6d88bed0ea2c4aee192320ab0
SHA1

cc5062b68194e72fcc39d78ec794eef77c631e11
SHA256

3f89ce5be773c28644ec626cd94037a02958f69cb9a571c6c69788af498e06c4
SHA512

fd370a4178ed0204241dd84df0e234b4c971c27ef8d6d7a423a1a1e0679ffd82d3879642f9d484f0089ea11785361104073fae26f860dbabd594b8300de3bd35

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/87f461a62a7de4013da81005cdc4ac08

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1784 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1784 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1784 powershell.exe
1784 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1784 powershell.exe

flow	pid	process
5	1784	powershell.exe

pid	process
1784	powershell.exe

pid	process
1784	powershell.exe
1784	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1784	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1620 wrote to memory of 1784	1620	cmd.exe	powershell.exe
PID 1620 wrote to memory of 1784	1620	cmd.exe	powershell.exe
PID 1620 wrote to memory of 1784	1620	cmd.exe	powershell.exe
PID 1620 wrote to memory of 1784	1620	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\87f461a62a7de4013da81005cdc4ac08.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

memory/1784-0-0x0000000000000000-mapping.dmp

Download
memory/1784-1-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1784-2-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/1784-3-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/1784-4-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1784-5-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/1784-8-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/1784-13-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/1784-14-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/1784-21-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1784-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download