7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
74s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_zero.bat
Size

147B
MD5

61ebbe729a83d344f375e709cdba0dfe
SHA1

b98eb57ca5cffdb330bf2fe2c2de4d935cac5ac6
SHA256

d7f1771ad9d42305becb45e44ff72b1de6f52444dbbc0ef0c26f209ea44d3d57
SHA512

da6681d21d980ba7b1ddf7fc023c82aacbad237334af0625895ba4bb1fb0e300133db909810a0ddaae79a8da1c1e00080a80157ad5b8a7a8857b5607c530ef59

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

1972 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 1972	1684	cmd.exe	miner.exe
PID 1684 wrote to memory of 1972	1684	cmd.exe	miner.exe
PID 1684 wrote to memory of 1972	1684	cmd.exe	miner.exe
PID 1684 wrote to memory of 1972	1684	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_zero.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo 192_7 --pers ZERO_PoW --server equihash192.mine.zergpool.com --port 2144 --user t1d1YLkZ94UhUE1G6nJLHA2Qf3HPD5JqgwQ.rig0 --pass x
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-2-0x0000000000000000-mapping.dmp

Download