7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
70s
max time network
67s
platform
windows10_x64
resource
win10v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_swap.bat
Size

167B
MD5

578b8e77341417db43159385c74f1810
SHA1

a8dd730cb232da75a19bbd701368eff1450ea12e
SHA256

6afad5abc7020dfc56542e59b9570a9a8c9a4235c75ea58d3da32047af9a9bd7
SHA512

bab735749a98860c7c7c0986539f8f5585afeef963f035855e07b48d69d2df9cbcb6dde00f01552bc6794a7099aa1be187b03ba226570205f3d1138c0fdc9e84

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 728 wrote to memory of 2452	728	cmd.exe	miner.exe
PID 728 wrote to memory of 2452	728	cmd.exe	miner.exe
PID 728 wrote to memory of 2452	728	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine_swap.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:728

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo swap --server swap2.luckypool.io --port 4466 --user fh3N9LqnL3ievSNFboKUg1H3Q5e9bg5QZFK4XjpdPe6J8AWU42PNyAZPHdPrbSwm6ZaBDpW7Mc7Nk8ukCKKJRAt438izdAdqw
2⤵
PID:2452

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-2-0x0000000000000000-mapping.dmp

Download