7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
78s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_zero.bat
Size

147B
MD5

61ebbe729a83d344f375e709cdba0dfe
SHA1

b98eb57ca5cffdb330bf2fe2c2de4d935cac5ac6
SHA256

d7f1771ad9d42305becb45e44ff72b1de6f52444dbbc0ef0c26f209ea44d3d57
SHA512

da6681d21d980ba7b1ddf7fc023c82aacbad237334af0625895ba4bb1fb0e300133db909810a0ddaae79a8da1c1e00080a80157ad5b8a7a8857b5607c530ef59

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 744 wrote to memory of 2328	744	cmd.exe	miner.exe
PID 744 wrote to memory of 2328	744	cmd.exe	miner.exe
PID 744 wrote to memory of 2328	744	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mine_zero.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo 192_7 --pers ZERO_PoW --server equihash192.mine.zergpool.com --port 2144 --user t1d1YLkZ94UhUE1G6nJLHA2Qf3HPD5JqgwQ.rig0 --pass x
2⤵
PID:2328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-2-0x0000000000000000-mapping.dmp

Download