e90566cb4749892ac21828eed527e7d1e01a02687e1180d5d6cf9931c0d55ef4

Analysis

max time kernel
435s
max time network
1157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 01:13

Target

data/getServer.bat
Size

465B
MD5

232d1a1851f0559cef9daab0223aad99
SHA1

cf638f2b61d7bfff85340628b5863b96e21dae3f
SHA256

49d403dd5e205c73434839a975cef8130a114c0efeb402e1bfb6be666d467bfe
SHA512

5224b2868b24c07f475c55f2b40324aed6e822bd804039912bc7a60a9ffb46ad39cbe5939e0af72328c082676c07e392f88b940ead4310cd6a9278975332af50

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 1076	4328	cmd.exe	81
PID 4328 wrote to memory of 1076	4328	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\data\getServer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\system32\curl.exe
  curl https://raw.githubusercontent.com/itsshux/ProcessSpoofer/main/data
  2⤵
  PID:1076

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact