Analysis
- max time kernel
1797s - max time network
1802s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/11/2024, 02:23
General
- Target pepew(Copy 3).bat
- Size 175B
- Sample241120-ct6tpstjfj
- SHA256 7713427365e7bbddcc5cd0903f7d847942b79c67640c085e8f5b1d5f70a7776e
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pepew(Copy 3).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SRBMiner.exeSRBMiner.exe --algorithm xelishashv2_pepew --pool stratum+tcp://na.mining4people.com:4176 --wallet PRnLRcurtkNtVx2MYeKrVUWWk9oRPLk4zM --password x --worker RiG3 --disable-gpu2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evb8984.tmp
evb89A4.tmp
evb89B5.tmp
memory/3272-42-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/3272-33-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-5-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-6-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-2-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-9-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/3272-3-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-26-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-18-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/3272-24-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-1-0x00007FF9BBC6D000-0x00007FF9BBC6E000-memory.dmp
memory/3272-27-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/3272-25-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-28-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-29-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-41-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-32-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-30-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-31-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-40-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-44-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-0-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-4-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-45-0x0000000022EE0000-0x0000000022F89000-memory.dmp
memory/3272-81-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-47-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-48-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-49-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-50-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-56-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-51-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-57-0x00007FF9BBBD0000-0x00007FF9BBDC5000-memory.dmp
memory/3272-58-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-66-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-63-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-68-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-76-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-73-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-46-0x00007FF9BBC6D000-0x00007FF9BBC6E000-memory.dmp
memory/3272-78-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-86-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-83-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-91-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/3272-88-0x0000000140000000-0x0000000143207000-memory.dmp
memory/3272-94-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/3272-95-0x000000037C1A0000-0x000000037C231000-memory.dmp