7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
27s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_aion.bat
Size

162B
MD5

648e1bd01b6ab048551285bd24f150c4
SHA1

6902ea2f7b556a5772a9ed6a65b5909da8fb3a9e
SHA256

c25af55cbb502e1c80dcb5c89ed26d248c2b10d0617e95ff4f5066b57feb2aae
SHA512

fdab90a02f6a636d5da5bf56ded63ef6c899a231569957e0a5abaf9b7d73d997a44c167ca6a9ec955615cb41e0c2746581e63393d80ec269aca8d6b17a0e69b7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

2016 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1800 wrote to memory of 2016	1800	cmd.exe	miner.exe
PID 1800 wrote to memory of 2016	1800	cmd.exe	miner.exe
PID 1800 wrote to memory of 2016	1800	cmd.exe	miner.exe
PID 1800 wrote to memory of 2016	1800	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_aion.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo 210_9 --pers AION0PoW --server aion-eu.luxor.tech --port 3366 --user 0xa07978089c76e2010720bec8400f05530cd946a567dc0fd9b862d83a45681f7c --pass x
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-2-0x0000000000000000-mapping.dmp

Download