87fae22d56dade8dd40b66dab4c4b7b4221e86f3750a96846ab64c755f5ba222 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 18:42

Sharing

Report Analysis Logs

General

Target

Start-Ethereum-Classic.bat
Size

139B
MD5

7d54540accbed77e2119a821897f8717
SHA1

a963577f21abaa6680597d9d314c0b02c432b602
SHA256

e4639f287a977b9a4292083bb09438f3ce4c277e5d7c2b1636ab69b9ed888566
SHA512

a6883301ca0dec8ef0defe27ef3f1d3d55e5453af63911ba422bd279c7e97e1a3d66f9ce503e02afa647355f4ed6d1045d9fd687b1c8808004225dc15f464525

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2380-0-0x000000013FB70000-0x0000000140B70000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2380	1044	cmd.exe	32
PID 1044 wrote to memory of 2380	1044	cmd.exe	32
PID 1044 wrote to memory of 2380	1044	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Start-Ethereum-Classic.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\bzminer.exe
  bzminer -a etchash -p stratum+tcp://etc.kryptex.network:7777 -w 0x529e3d7050aa576fe3ead29ca321aee2b146727f.MyFirstRig --nc 1
  2⤵
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x000000013FB70000-0x0000000140B70000-memory.dmp

Filesize
16.0MB

Download