7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
47s
max time network
107s
platform
windows10_x64
resource
win10v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_grin29.bat
Size

100B
MD5

8650e2bfc291287d2518fb2edc929464
SHA1

fd85db66aa36c0df9361d26187b7129540b5da23
SHA256

14a829e66222a2caf7ffe2a9f582353b46df4461ec1aad8abca1b8859ec23c2f
SHA512

968f6542b9dd9c2c74fe79bb4d426bc0f43bf81763cc34bce4bf2f61faf6d93359bb625c25807aec9cf8b63f47eac63fb0cdfdeae8e094938ce3adcc2c0100af

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4768 wrote to memory of 5096	4768	cmd.exe	miner.exe
PID 4768 wrote to memory of 5096	4768	cmd.exe	miner.exe
PID 4768 wrote to memory of 5096	4768	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine_grin29.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo grin29 --server grin.sparkpool.com --port 6666 --user admin@develsoftware.com/rig0
2⤵
PID:5096

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-2-0x0000000000000000-mapping.dmp

Download