853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818

Analysis

Target
853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe
Size 3.3MB
Sample201112-2av8sgfp2n
SHA256 853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818
MD5 ccd8c336436e6c989be6348f27cb4900
SHA1 db29a4752cef1402a0ebf4d51b050d9035778b64
SHA512 d6b9efc5708a64bffde09900def1639ee15417fff44dd200fadb1364fdda58cb13ff087fc6036588c93534cd366d81169bef93d7c737c0009ed8daf549798a88
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
816	powershell.exe
816	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 816	1804	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	29
PID 1804 wrote to memory of 816	1804	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	29
PID 1804 wrote to memory of 816	1804	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	29
PID 1804 wrote to memory of 816	1804	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	29
PID 816 wrote to memory of 1328	816	powershell.exe	31
PID 816 wrote to memory of 1328	816	powershell.exe	31
PID 816 wrote to memory of 1328	816	powershell.exe	31
PID 1328 wrote to memory of 368	1328	csc.exe	32
PID 1328 wrote to memory of 368	1328	csc.exe	32
PID 1328 wrote to memory of 368	1328	csc.exe	32

C:\Users\Admin\AppData\Local\Temp\853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe
"C:\Users\Admin\AppData\Local\Temp\853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n04aqvuh\n04aqvuh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5080.tmp" "c:\Users\Admin\AppData\Local\Temp\n04aqvuh\CSC75A5BF0F14634810AD79C485DFF23EF7.TMP"
      4⤵
      PID:368

memory/816-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/816-5-0x000000001ABB0000-0x000000001ABB1000-memory.dmp

Download

memory/816-9-0x000000001B740000-0x000000001B741000-memory.dmp

Download

memory/816-7-0x0000000001E40000-0x0000000001E41000-memory.dmp

Download

memory/816-6-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/816-3-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Download

memory/816-17-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/1804-0-0x0000000002150000-0x000000000248E000-memory.dmp

Download

memory/1804-1-0x0000000002490000-0x00000000024A1000-memory.dmp

Download