853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818

Analysis

Target
853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe
Size 3.3MB
Sample201112-2av8sgfp2n
SHA256 853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818
MD5 ccd8c336436e6c989be6348f27cb4900
SHA1 db29a4752cef1402a0ebf4d51b050d9035778b64
SHA512 d6b9efc5708a64bffde09900def1639ee15417fff44dd200fadb1364fdda58cb13ff087fc6036588c93534cd366d81169bef93d7c737c0009ed8daf549798a88
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2836	3980	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	79
PID 3980 wrote to memory of 2836	3980	853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe	79
PID 2836 wrote to memory of 3960	2836	powershell.exe	81
PID 2836 wrote to memory of 3960	2836	powershell.exe	81
PID 3960 wrote to memory of 4064	3960	csc.exe	82
PID 3960 wrote to memory of 4064	3960	csc.exe	82

C:\Users\Admin\AppData\Local\Temp\853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe
"C:\Users\Admin\AppData\Local\Temp\853dd613a361ded145d8997fddce02ff8183be8f0d400ce5121dfabda5c27818.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- \??\c:\windows\System32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ptfn1tuc\ptfn1tuc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65A5.tmp" "c:\Users\Admin\AppData\Local\Temp\ptfn1tuc\CSCAF58D6E715FD4BFAAB4D10F26ADD9830.TMP"
      4⤵
      PID:4064

memory/2836-3-0x00007FFF6D290000-0x00007FFF6DC7C000-memory.dmp

Download

memory/2836-4-0x0000024C74250000-0x0000024C74251000-memory.dmp

Download

memory/2836-5-0x0000024C74400000-0x0000024C74401000-memory.dmp

Download

memory/2836-14-0x0000024C74390000-0x0000024C74391000-memory.dmp

Download

memory/3980-1-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download