Overview
overview
5Static
static
51.bat
windows11-21h2-x64
510.bat
windows11-21h2-x64
511.bat
windows11-21h2-x64
512.bat
windows11-21h2-x64
513.bat
windows11-21h2-x64
514.bat
windows11-21h2-x64
515.bat
windows11-21h2-x64
516.bat
windows11-21h2-x64
517.bat
windows11-21h2-x64
518.bat
windows11-21h2-x64
519.bat
windows11-21h2-x64
52.bat
windows11-21h2-x64
520.bat
windows11-21h2-x64
521.bat
windows11-21h2-x64
522.bat
windows11-21h2-x64
523.bat
windows11-21h2-x64
524.bat
windows11-21h2-x64
525.bat
windows11-21h2-x64
526.bat
windows11-21h2-x64
527.bat
windows11-21h2-x64
528.bat
windows11-21h2-x64
529.bat
windows11-21h2-x64
53.bat
windows11-21h2-x64
530.bat
windows11-21h2-x64
531.bat
windows11-21h2-x64
532.bat
windows11-21h2-x64
533.bat
windows11-21h2-x64
534.bat
windows11-21h2-x64
535.bat
windows11-21h2-x64
536.bat
windows11-21h2-x64
537.bat
windows11-21h2-x64
538.bat
windows11-21h2-x64
5Resubmissions
18/10/2024, 12:37
241018-ptwpysxbqb 518/10/2024, 11:27
241018-nkhlasthne 518/10/2024, 10:20
241018-mc3qts1fqf 518/10/2024, 09:39
241018-lmldvssdkr 518/10/2024, 07:50
241018-jpb7vsyakq 518/10/2024, 05:22
241018-f2ypvasemr 517/10/2024, 22:48
241017-2repwa1drh 5Analysis
-
max time kernel
1790s -
max time network
1785s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/10/2024, 09:39
Behavioral task
behavioral1
Sample
1.bat
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
10.bat
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
11.bat
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
12.bat
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
13.bat
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
14.bat
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
15.bat
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
16.bat
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
17.bat
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
18.bat
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
19.bat
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
2.bat
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
20.bat
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
21.bat
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
22.bat
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
23.bat
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
24.bat
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
25.bat
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
26.bat
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
27.bat
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
28.bat
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
29.bat
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
3.bat
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
30.bat
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
31.bat
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
32.bat
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
33.bat
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
34.bat
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
35.bat
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
36.bat
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
37.bat
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
38.bat
Resource
win11-20241007-en
General
-
Target
20.bat
-
Size
116B
-
MD5
e5fabf2c3e749ba27836edb76b41db16
-
SHA1
bdc6e2eb78ebf221d1acc41835e3a9992269d57e
-
SHA256
a30a2ecaebe9755a9b04da590e731bb0a8eacbf6e8020e98ba38cf3f8f9534ac
-
SHA512
172f9345d1a4676f7b5a7711ee31eb3ec749494d82ec6305a4848d0b8f25902d7db10d808b82da7b8fe17cabc0d3441569020b29242469b42bb6e95ce029a2ef
Malware Config
Signatures
-
resource yara_rule behavioral13/memory/2988-0-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-1-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-2-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-3-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-5-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-6-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-7-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-8-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-11-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-12-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-13-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-14-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-16-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-18-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-19-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-22-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-25-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-26-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-28-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-29-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-30-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-32-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-34-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-36-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-39-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-40-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-41-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-43-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-45-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-46-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-47-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-48-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-52-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-58-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-59-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-60-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-62-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-63-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx behavioral13/memory/2988-64-0x00007FF6823D0000-0x00007FF682A57000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2988 cpuminer-sse2.exe Token: SeLockMemoryPrivilege 2988 cpuminer-sse2.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2988 1800 cmd.exe 78 PID 1800 wrote to memory of 2988 1800 cmd.exe 78
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\20.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\cpuminer-sse2.execpuminer-sse2.exe -a yespowerTIDE -o stratum+tcp://stratum-eu.rplant.xyz:7059 -u TD368ah8Kuzn2quR7g6r8sUYbsVvKzwpyc2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-