4e32e4d62180dede1cf54d34399adf7fb06464604842d6551ba3d2077ce6d5c8

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 11:21

Target

sekmeme olta/sekmemeotoayar.bat
Size

12KB
MD5

b585b6ebb583d11eebb2ff5392d27724
SHA1

98e215b33ee123d0f3e1d9ca88af3d6ea2c89a3c
SHA256

a3a60d095e054a2fb6b951cb499df5bae45d6c4361cd9c3a338a61690e388ea1
SHA512

ce07e1daeec628ef391c0b11d6240e9606c8440d3cf09217b81788e7d0de5ecdbd66653a57276d6c3731523c6a64ac921b5e870386b571828d201f86481496c3
SSDEEP

384:1bvuYOOQ1CvlyejVghBYjiVKRq5aixzorf9BLEHQ:1bXf8oKK80ixuUHQ

Score

10^/10

Language

ps1

Source

URLs

exe.dropper

https://cdn.discordapp.com/attachments/1167569425721995295/1167776678743908422/Exela.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

664 powershell.exe
664 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 664 powershell.exe

pid	process
664	powershell.exe
664	powershell.exe

description	pid	process
Token: SeDebugPrivilege	664	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3432 wrote to memory of 2752	3432	cmd.exe	fsutil.exe
PID 3432 wrote to memory of 2752	3432	cmd.exe	fsutil.exe
PID 3432 wrote to memory of 664	3432	cmd.exe	powershell.exe
PID 3432 wrote to memory of 664	3432	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sekmeme olta\sekmemeotoayar.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3432

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iixmj4q2.h43.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/664-9-0x000002285B720000-0x000002285B742000-memory.dmp

Filesize
136KB

Download
memory/664-10-0x00007FFB34160000-0x00007FFB34C21000-memory.dmp

Filesize
10.8MB

Download
memory/664-11-0x000002285B7A0000-0x000002285B7B0000-memory.dmp

Filesize
64KB

Download
memory/664-12-0x000002285B7A0000-0x000002285B7B0000-memory.dmp

Filesize
64KB

Download
memory/664-13-0x000002285B7A0000-0x000002285B7B0000-memory.dmp

Filesize
64KB

Download
memory/664-14-0x000002285DB60000-0x000002285DB86000-memory.dmp

Filesize
152KB

Download
memory/664-15-0x000002285DBC0000-0x000002285DBD4000-memory.dmp

Filesize
80KB

Download
memory/664-16-0x00007FFB34160000-0x00007FFB34C21000-memory.dmp

Filesize
10.8MB

Download
memory/664-17-0x000002285B7A0000-0x000002285B7B0000-memory.dmp

Filesize
64KB

Download
memory/664-20-0x000002285B7A0000-0x000002285B7B0000-memory.dmp

Filesize
64KB

Download
memory/664-21-0x00007FFB34160000-0x00007FFB34C21000-memory.dmp

Filesize
10.8MB

Download