Overview
overview
5Static
static
51.bat
windows7-x64
51.bat
windows10-2004-x64
510.bat
windows7-x64
510.bat
windows10-2004-x64
511.bat
windows7-x64
511.bat
windows10-2004-x64
512.bat
windows7-x64
512.bat
windows10-2004-x64
513.bat
windows7-x64
513.bat
windows10-2004-x64
514.bat
windows7-x64
514.bat
windows10-2004-x64
515.bat
windows7-x64
515.bat
windows10-2004-x64
516.bat
windows7-x64
516.bat
windows10-2004-x64
517.bat
windows7-x64
517.bat
windows10-2004-x64
518.bat
windows7-x64
518.bat
windows10-2004-x64
519.bat
windows7-x64
519.bat
windows10-2004-x64
52.bat
windows7-x64
52.bat
windows10-2004-x64
520.bat
windows7-x64
520.bat
windows10-2004-x64
521.bat
windows7-x64
521.bat
windows10-2004-x64
522.bat
windows7-x64
522.bat
windows10-2004-x64
523.bat
windows7-x64
523.bat
windows10-2004-x64
5Resubmissions
18/10/2024, 12:37
241018-ptwpysxbqb 518/10/2024, 11:27
241018-nkhlasthne 518/10/2024, 10:20
241018-mc3qts1fqf 518/10/2024, 09:39
241018-lmldvssdkr 518/10/2024, 07:50
241018-jpb7vsyakq 518/10/2024, 05:22
241018-f2ypvasemr 517/10/2024, 22:48
241017-2repwa1drh 5Analysis
-
max time kernel
1791s -
max time network
1798s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 05:22
Behavioral task
behavioral1
Sample
1.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
10.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
10.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
11.bat
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
11.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
12.bat
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
12.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
13.bat
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
13.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
14.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
14.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
15.bat
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
15.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
16.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
16.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
17.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
17.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
18.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
18.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
19.bat
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
19.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
2.bat
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
20.bat
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
20.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
21.bat
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
21.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
22.bat
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
22.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
23.bat
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
23.bat
Resource
win10v2004-20241007-en
General
-
Target
13.bat
-
Size
116B
-
MD5
e5fabf2c3e749ba27836edb76b41db16
-
SHA1
bdc6e2eb78ebf221d1acc41835e3a9992269d57e
-
SHA256
a30a2ecaebe9755a9b04da590e731bb0a8eacbf6e8020e98ba38cf3f8f9534ac
-
SHA512
172f9345d1a4676f7b5a7711ee31eb3ec749494d82ec6305a4848d0b8f25902d7db10d808b82da7b8fe17cabc0d3441569020b29242469b42bb6e95ce029a2ef
Malware Config
Signatures
-
resource yara_rule behavioral10/memory/4736-0-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-1-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-2-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-3-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-6-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-7-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-8-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-9-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-10-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-11-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-12-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-14-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-15-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-16-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-17-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-18-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-19-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-20-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-24-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-25-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-26-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-28-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-31-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-32-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-33-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-34-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-35-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-36-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-37-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-38-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-39-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-40-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-42-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-43-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-44-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-46-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-47-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-48-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-49-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-50-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-51-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-52-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-56-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-57-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-58-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-59-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-62-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-63-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx behavioral10/memory/4736-64-0x00007FF68B8E0000-0x00007FF68BF67000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4736 cpuminer-sse2.exe Token: SeLockMemoryPrivilege 4736 cpuminer-sse2.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3252 wrote to memory of 4736 3252 cmd.exe 85 PID 3252 wrote to memory of 4736 3252 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\13.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespowerTIDE -o stratum+tcp://stratum-eu.rplant.xyz:7059 -u TD368ah8Kuzn2quR7g6r8sUYbsVvKzwpyc2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-