ad80a704ac0ce9868279a0a3d4e85a2582aff13a9e24a0b46478800fa341b260

Analysis

max time kernel
1561s
max time network
1563s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 23:55

Target

2.bat
Size

779B
MD5

f80b95d6836f18d936105783c4e2c186
SHA1

b95ee9d9ea1d9df6d5dc16ffb400f34a497823a6
SHA256

ad80a704ac0ce9868279a0a3d4e85a2582aff13a9e24a0b46478800fa341b260
SHA512

c50803b213cda537b254633ad48c70bff055b04fdb99829e898d2c7626a24d018709b35dc92f1e89b217f9bb6efafbd2e5074a32e307a89830b8453b4bee1291

Score

7^/10

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1140	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1140	1368	cmd.exe	29
PID 1368 wrote to memory of 1140	1368	cmd.exe	29
PID 1368 wrote to memory of 1140	1368	cmd.exe	29
PID 1368 wrote to memory of 2908	1368	cmd.exe	30
PID 1368 wrote to memory of 2908	1368	cmd.exe	30
PID 1368 wrote to memory of 2908	1368	cmd.exe	30
PID 2908 wrote to memory of 2936	2908	cmd.exe	31
PID 2908 wrote to memory of 2936	2908	cmd.exe	31
PID 2908 wrote to memory of 2936	2908	cmd.exe	31
PID 2908 wrote to memory of 2880	2908	cmd.exe	32
PID 2908 wrote to memory of 2880	2908	cmd.exe	32
PID 2908 wrote to memory of 2880	2908	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com 2>NUL|find "Address:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    PID:2936
- - C:\Windows\system32\find.exe
    find "Address:"
    3⤵
    PID:2880

memory/1140-58-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/1140-59-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1140-60-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1140-61-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/1140-62-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/1140-63-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/1140-64-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1140-65-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/1140-66-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download