77fdb26fe7da9554fb8c26d0aec9ece43f41e4c44c48e2917a8a167f25e26f9c

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 23:38

Target

astrominer-V1.9_windows.zip
Size

1.9MB
MD5

73c79a07efd434a15f89f0e2218c08c4
SHA1

dc6482099b287fbec2fe6cd5efb8e597ed072ab1
SHA256

77fdb26fe7da9554fb8c26d0aec9ece43f41e4c44c48e2917a8a167f25e26f9c
SHA512

d0910313ee2be3699ca1191b19df117c6279b2df2b36fc33bfb61e93b6b0ec7974455a8e14f593f3833103d4a660d0458189a9bae46349899077d202905f5aa6
SSDEEP

49152:xmzmmUfhMXXxqxfULFJnMa48SyDOy/KtHvofPUPkRK:xHfhwXxqxiJnrSWOeKJofPUPaK

Score

7^/10

upx

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2084-133-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-134-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-136-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-138-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-140-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-142-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-144-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-146-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-148-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-150-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-152-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx
behavioral3/memory/3828-154-0x00007FF780070000-0x00007FF78050B000-memory.dmp	upx

Unexpected DNS network traffic destination 16 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2084	2196	cmd.exe	106
PID 2196 wrote to memory of 2084	2196	cmd.exe	106
PID 2084 wrote to memory of 4624	2084	astrominer.exe	107
PID 2084 wrote to memory of 4624	2084	astrominer.exe	107
PID 4624 wrote to memory of 3828	4624	cmd.exe	108
PID 4624 wrote to memory of 3828	4624	cmd.exe	108

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\astrominer-V1.9_windows.zip
1⤵
PID:4120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\astrominer-V1.9_windows\rpc_mine.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\Desktop\astrominer-V1.9_windows\astrominer.exe
  astrominer.exe -w YOUR_ADDRESS -r YOUR_RPC_IP:YOUR_RPC_PORT -p rpc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c astrominer.exe -w YOUR_ADDRESS -r YOUR_RPC_IP:YOUR_RPC_PORT -p rpc -no-watchdog
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\Desktop\astrominer-V1.9_windows\astrominer.exe
      astrominer.exe -w YOUR_ADDRESS -r YOUR_RPC_IP:YOUR_RPC_PORT -p rpc -no-watchdog
      4⤵
      PID:3828

memory/2084-133-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-134-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-136-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-138-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-140-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-142-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-144-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-146-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-148-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-150-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-152-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download
memory/3828-154-0x00007FF780070000-0x00007FF78050B000-memory.dmp

Filesize
4.6MB

Download