b5877c4cc1d72694fa3faafa1879979975365e52e7232eb6a3a9fe8aef4aea3c

Analysis

Target

5436705d1e25ce0a762a32c200158950.bat
Size

218B
MD5

a9f336d51108c56fda11701557ded1ec
SHA1

57aa584c781307cf32c1ff13800d0e2acdc3eb3e
SHA256

b5877c4cc1d72694fa3faafa1879979975365e52e7232eb6a3a9fe8aef4aea3c
SHA512

4c54738d6e6c73cba4f1376276314ee6a8ad69a33ca1eb5b011f2a46d78def7e44b01d9349495f366433ea8582fb0bdae124f554be08fa6fc314437703893274

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/5436705d1e25ce0a762a32c200158950

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1512 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1512 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1512 powershell.exe
1512 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1512 powershell.exe

flow	pid	process
5	1512	powershell.exe

pid	process
1512	powershell.exe

pid	process
1512	powershell.exe
1512	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1512	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1588 wrote to memory of 1512	1588	cmd.exe	powershell.exe
PID 1588 wrote to memory of 1512	1588	cmd.exe	powershell.exe
PID 1588 wrote to memory of 1512	1588	cmd.exe	powershell.exe
PID 1588 wrote to memory of 1512	1588	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\5436705d1e25ce0a762a32c200158950.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

memory/1512-0-0x0000000000000000-mapping.dmp

Download
memory/1512-1-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/1512-2-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1512-3-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/1512-4-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1512-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1512-8-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1512-13-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1512-14-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/1512-21-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1512-22-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download