ae3f46c16eabaaebf0b54c7380a58499c390dfcd8ee5fedec878d7bbfb6a7a01

Analysis

max time kernel
1557s
max time network
1560s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/08/2023, 19:33

Target

2.bat
Size

917B
MD5

c83af19fcf6fd4919327991ca7f38fee
SHA1

daab8761b448083f6ff7a71a173120ebef637efe
SHA256

ae3f46c16eabaaebf0b54c7380a58499c390dfcd8ee5fedec878d7bbfb6a7a01
SHA512

3166984303fcd700c6c1bd8f612dc4e473104fdea03a5527ba171f581b58b1ef988ad7d990282046ceb2f8d0c4ad2be1ac8c7504cf61de4c7c63a72e7816bfb3

Score

7^/10

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2184	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1504	3000	cmd.exe	29
PID 3000 wrote to memory of 1504	3000	cmd.exe	29
PID 3000 wrote to memory of 1504	3000	cmd.exe	29
PID 3000 wrote to memory of 2184	3000	cmd.exe	30
PID 3000 wrote to memory of 2184	3000	cmd.exe	30
PID 3000 wrote to memory of 2184	3000	cmd.exe	30
PID 3000 wrote to memory of 2368	3000	cmd.exe	31
PID 3000 wrote to memory of 2368	3000	cmd.exe	31
PID 3000 wrote to memory of 2368	3000	cmd.exe	31
PID 2368 wrote to memory of 2436	2368	cmd.exe	32
PID 2368 wrote to memory of 2436	2368	cmd.exe	32
PID 2368 wrote to memory of 2436	2368	cmd.exe	32
PID 2368 wrote to memory of 2428	2368	cmd.exe	33
PID 2368 wrote to memory of 2428	2368	cmd.exe	33
PID 2368 wrote to memory of 2428	2368	cmd.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com 2>NUL|find "Address:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    PID:2436
- - C:\Windows\system32\find.exe
    find "Address:"
    3⤵
    PID:2428

memory/1504-58-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/1504-59-0x0000000002090000-0x0000000002098000-memory.dmp

Filesize
32KB

Download
memory/1504-60-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download
memory/1504-61-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/1504-62-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download
memory/1504-63-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download