7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
56s
max time network
106s
platform
windows10_x64
resource
win10v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_grin31.bat
Size

100B
MD5

f6bdefeea64ebc6b5d7ab19c45f83118
SHA1

d71ac32827eaff4cca21f89481ead2a8adcaa68b
SHA256

456cebb343f24a4551bfc3a140fcae8f3be0a3523b44608af848fc35a5f235f3
SHA512

e893a350695bf63edd592f5a9cc29d17aac135527bb6965e1e42f42b5a248f998ad5db507b48b3c0a41824e56fb0f9104220e38df0fe052a5aeeb2df89d81298

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1212 wrote to memory of 4064	1212	cmd.exe	miner.exe
PID 1212 wrote to memory of 4064	1212	cmd.exe	miner.exe
PID 1212 wrote to memory of 4064	1212	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine_grin31.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo grin31 --server grin.sparkpool.com --port 6667 --user [email protected]/rig0
2⤵
PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-2-0x0000000000000000-mapping.dmp

Download