7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
47s
max time network
30s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_grin29.bat
Size

100B
MD5

8650e2bfc291287d2518fb2edc929464
SHA1

fd85db66aa36c0df9361d26187b7129540b5da23
SHA256

14a829e66222a2caf7ffe2a9f582353b46df4461ec1aad8abca1b8859ec23c2f
SHA512

968f6542b9dd9c2c74fe79bb4d426bc0f43bf81763cc34bce4bf2f61faf6d93359bb625c25807aec9cf8b63f47eac63fb0cdfdeae8e094938ce3adcc2c0100af

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

1444 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1872 wrote to memory of 1444	1872	cmd.exe	miner.exe
PID 1872 wrote to memory of 1444	1872	cmd.exe	miner.exe
PID 1872 wrote to memory of 1444	1872	cmd.exe	miner.exe
PID 1872 wrote to memory of 1444	1872	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_grin29.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo grin29 --server grin.sparkpool.com --port 6666 --user admin@develsoftware.com/rig0
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1444

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-2-0x0000000000000000-mapping.dmp

Download