7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_grin31.bat
Size

100B
MD5

f6bdefeea64ebc6b5d7ab19c45f83118
SHA1

d71ac32827eaff4cca21f89481ead2a8adcaa68b
SHA256

456cebb343f24a4551bfc3a140fcae8f3be0a3523b44608af848fc35a5f235f3
SHA512

e893a350695bf63edd592f5a9cc29d17aac135527bb6965e1e42f42b5a248f998ad5db507b48b3c0a41824e56fb0f9104220e38df0fe052a5aeeb2df89d81298

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

1900 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 384 wrote to memory of 1900	384	cmd.exe	miner.exe
PID 384 wrote to memory of 1900	384	cmd.exe	miner.exe
PID 384 wrote to memory of 1900	384	cmd.exe	miner.exe
PID 384 wrote to memory of 1900	384	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_grin31.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo grin31 --server grin.sparkpool.com --port 6667 --user admin@develsoftware.com/rig0
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-2-0x0000000000000000-mapping.dmp

Download