6404114463be10557553648d2adbd3fad665f24bdf9596ae4eac9b1c085728cd

Analysis

Target

7cbc48d6ae9ecd184f501f7b6335c610.bat
Size

216B
MD5

f413de542b9c7ffad61e390a12df9530
SHA1

f533e65ef43aa735f705c4e90453ab73191030a9
SHA256

6404114463be10557553648d2adbd3fad665f24bdf9596ae4eac9b1c085728cd
SHA512

ec5cc6220178daa514948eb3490643101495f69dcc9b73d0c8692a14107420e0f97fd34a7045d5479f905022e72ee835b62a375a33fde085e7f7732d3711e1a2

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/7cbc48d6ae9ecd184f501f7b6335c610

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1872 powershell.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1872 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1872 powershell.exe
1872 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1872 powershell.exe

flow	pid	process
5	1872	powershell.exe

pid	process
1872	powershell.exe

pid	process
1872	powershell.exe
1872	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1036 wrote to memory of 1872	1036	cmd.exe	powershell.exe
PID 1036 wrote to memory of 1872	1036	cmd.exe	powershell.exe
PID 1036 wrote to memory of 1872	1036	cmd.exe	powershell.exe
PID 1036 wrote to memory of 1872	1036	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\7cbc48d6ae9ecd184f501f7b6335c610.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

memory/1872-0-0x0000000000000000-mapping.dmp

Download
memory/1872-1-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/1872-2-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/1872-3-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/1872-4-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1872-5-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1872-8-0x0000000006050000-0x0000000006051000-memory.dmp

Filesize
4KB

Download
memory/1872-13-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/1872-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1872-21-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/1872-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download