Analysis

  • max time kernel
    67s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 15:47

General

  • Target

    mine_swap.bat

  • Size

    167B

  • MD5

    578b8e77341417db43159385c74f1810

  • SHA1

    a8dd730cb232da75a19bbd701368eff1450ea12e

  • SHA256

    6afad5abc7020dfc56542e59b9570a9a8c9a4235c75ea58d3da32047af9a9bd7

  • SHA512

    bab735749a98860c7c7c0986539f8f5585afeef963f035855e07b48d69d2df9cbcb6dde00f01552bc6794a7099aa1be187b03ba226570205f3d1138c0fdc9e84

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_swap.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\miner.exe
      miner.exe --algo swap --server swap2.luckypool.io --port 4466 --user fh3N9LqnL3ievSNFboKUg1H3Q5e9bg5QZFK4XjpdPe6J8AWU42PNyAZPHdPrbSwm6ZaBDpW7Mc7Nk8ukCKKJRAt438izdAdqw
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1984-2-0x0000000000000000-mapping.dmp