7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
67s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_swap.bat
Size

167B
MD5

578b8e77341417db43159385c74f1810
SHA1

a8dd730cb232da75a19bbd701368eff1450ea12e
SHA256

6afad5abc7020dfc56542e59b9570a9a8c9a4235c75ea58d3da32047af9a9bd7
SHA512

bab735749a98860c7c7c0986539f8f5585afeef963f035855e07b48d69d2df9cbcb6dde00f01552bc6794a7099aa1be187b03ba226570205f3d1138c0fdc9e84

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

1984 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2028 wrote to memory of 1984	2028	cmd.exe	miner.exe
PID 2028 wrote to memory of 1984	2028	cmd.exe	miner.exe
PID 2028 wrote to memory of 1984	2028	cmd.exe	miner.exe
PID 2028 wrote to memory of 1984	2028	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_swap.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo swap --server swap2.luckypool.io --port 4466 --user fh3N9LqnL3ievSNFboKUg1H3Q5e9bg5QZFK4XjpdPe6J8AWU42PNyAZPHdPrbSwm6ZaBDpW7Mc7Nk8ukCKKJRAt438izdAdqw
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-2-0x0000000000000000-mapping.dmp

Download