c1b0e7ce2a825a31f4c8a9ae3ee4e9955cd989e8f9854263569c5c61ccd908f0

Analysis

max time kernel
142s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PXuJ2cR6.ps1
Size 2KB
Sample230630-stctmaef5y
SHA256 c1b0e7ce2a825a31f4c8a9ae3ee4e9955cd989e8f9854263569c5c61ccd908f0
MD5 c977f842f0ac84e98c9045ef6d208522
SHA1 257cd850b5f9da348e2e9b05c68e483ec4405284
SHA512 268e4b1d0cd3b28deacde8150547d216a1a910251f95995534358506ea99909514493c08692cc39c3cecdc9ecb817c3575f77c5a1b9d927429143a9051d3bb8e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
123felix

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
43	4980	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2100	4980	powershell.exe	85
PID 4980 wrote to memory of 2100	4980	powershell.exe	85
PID 2100 wrote to memory of 2572	2100	csc.exe	86
PID 2100 wrote to memory of 2572	2100	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\PXuJ2cR6.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dxjw0zbt\dxjw0zbt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C99.tmp" "c:\Users\Admin\AppData\Local\Temp\dxjw0zbt\CSC8660CB833622485882BC9D495414AE4.TMP"
    3⤵
    PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES6C99.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C99.tmp
Size 1KB
SHA256 cf5e36bdb6687ab7b78d63dc3ad0db8ed744b79d98a3126c2a3e598a83223f1f
MD5 8f16e3acae79796cb034d69759d994cf
SHA1 78b2d0671996c620c8ed5e092e651853e2ace04a
SHA512 405409be4700a76b25107ac25f48840435658581a19c62486f32aba3d1889245b7d63beb572e6ab81b803beb4ef7da40dfceec601765955ebc0677c43e6d61ee
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2yrzlgna.02k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yrzlgna.02k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dxjw0zbt.dll

Path C:\Users\Admin\AppData\Local\Temp\dxjw0zbt\dxjw0zbt.dll
Size 3KB
SHA256 6917424295f9051d5d250f49a971896f5667de9e282ae39dcac7b210e31f5619
MD5 e75b6c6914c331559b1c92ee480df1a6
SHA1 4b55c68a9348e39128510370a60c024aa71ac52c
SHA512 a260d0676a7e4207e3d1f491125a9d94a53cf3ee7a342b92b3dac9fec9528bab490d2762a36e854ca161e566415e2d7f430ede2a4bfd40041bfaa04d5f183a3e
MD5 SHA1 SHA512

Submit Download

CSC8660CB833622485882BC9D495414AE4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dxjw0zbt\CSC8660CB833622485882BC9D495414AE4.TMP
Size 652B
SHA256 2b51be8824fe4a817ce5d23aacb2ec8447ecce7a2901d5c4a5f7ab1c0fc21d95
MD5 234da9543065ecb1ca501980ed47ab84
SHA1 66a9946f2eefff7095dc85043979a88b7e314519
SHA512 914687484e99a12b59be252ee18a8c554ff55fd74e359205c32f44806854f0cc5954c802413763d03d4059b286aeb5f0ebf6044a819d614beab24c19532b5bf4
MD5 SHA1 SHA512

Submit Download

dxjw0zbt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dxjw0zbt\dxjw0zbt.0.cs
Size 675B
SHA256 fdd65a6b830b7e3ab5d114f9f9aa5bdf4e47bbf0ed784389b6d6fd454c708470
MD5 61a7afcfb915aa8b873e11a8494b0f2e
SHA1 893ce0a14d8cc37c7266425a5c05d358f0c2c7d3
SHA512 2c8d4dedc6ac8ce594ae06696fc1a23fb9ab4eee04168663ef24dc1092d29f3145c782e02e49f9e6562877ead1ec596873fb623679691b824a07db0c71e5c46d
MD5 SHA1 SHA512

Submit Download

dxjw0zbt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dxjw0zbt\dxjw0zbt.cmdline
Size 369B
SHA256 19b4a5da8cf8a2fd9d18adfd22c8099f2776c98139cc047bab065af13ed6a90f
MD5 79a3f9d859d33315ada0fa7e2e9f241c
SHA1 29703807ace6454ebd3b670df58e618f12364a4b
SHA512 eb8119a91edf5fb3baf675fdca8b089c1cbcd11b22c3ab19757d18be7b62092d3e120308dd6989703830ee1e3c0433a6899f464e11b6e514829ed657a52afed3
MD5 SHA1 SHA512

Submit Download

memory/4980-133-0x0000018B30F60000-0x0000018B30F82000-memory.dmp

Download

memory/4980-145-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download

memory/4980-143-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download

memory/4980-144-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download

memory/4980-159-0x0000018B30FF0000-0x0000018B3120C000-memory.dmp

Download

memory/4980-161-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download

memory/4980-162-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download

memory/4980-160-0x0000018B30FB0000-0x0000018B30FC0000-memory.dmp

Download