7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
66s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_mnx.bat
Size

135B
MD5

f2c6df0305c6d3505a2374589ed3a434
SHA1

55a69c828f245c6635a8fbc322b93e0611f3174f
SHA256

5ed4eca3dea3372962f3b54eb88770c7ca02d5f227f0923041b49c7a0f78a936
SHA512

9a95d2d5a63082a2d0c0c06f11cba41f6a47f7ef1313851eebf7a99e9521a5b1a3e7b69a9103abffd04fee5dc234bbf981c3b632a30aa35d98b54954fe184c3c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3964 wrote to memory of 576	3964	cmd.exe	miner.exe
PID 3964 wrote to memory of 576	3964	cmd.exe	miner.exe
PID 3964 wrote to memory of 576	3964	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine_mnx.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo 96_5 --pers ZcashPoW --server mnx-eu.forgetop.com --port 5052 --user XSujWA99m3dPgCepUeSkvn5ro5TSqGaXEY.rig0 --pass x
2⤵
PID:576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-2-0x0000000000000000-mapping.dmp

Download