7cc35d1eb6961c962ae9fae96b4564c3f47d17b105af731910afe336f744f8ca | Triage

Analysis

max time kernel
34s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 15:47

Sharing

Report Analysis Logs

General

Target

mine_btcz.bat
Size

150B
MD5

05fec97b2b30fc588f9d3baf371778d1
SHA1

a21d75bc833706fa4abfec83d44d14c60aba06c3
SHA256

37b1379debe4278fa47fca5cc1bafb13517e4be363000ce901e50d6ea05aa280
SHA512

2ce8fedf687c83cdf1555ff7cd82125f3497e79205de6d601b205393835178df2c2064122b00d8c1a3f810cce5b8aa9340ef04fafe0ab12b63ec420047c63ab4

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

miner.exe

pid process

2004 miner.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 784 wrote to memory of 2004	784	cmd.exe	miner.exe
PID 784 wrote to memory of 2004	784	cmd.exe	miner.exe
PID 784 wrote to memory of 2004	784	cmd.exe	miner.exe
PID 784 wrote to memory of 2004	784	cmd.exe	miner.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\mine_btcz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\miner.exe
miner.exe --algo 144_5 --pers BitcoinZ --server mine-btcz-euro.equipool.1ds.us --port 50063 --user t1duyePXARPE7pm7WdJxxeA45o6efUk3cWR.rig0 --pass x
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-2-0x0000000000000000-mapping.dmp

Download