Analysis
- max time kernel
1795s - max time network
1804s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/11/2024, 02:23
General
- Target pepew(Copy 32).bat
- Size 176B
- Sample241120-ct6tpstjfj
- SHA256 88413a3c3e58e7427f92de0083923b8e88ef1fbbd00b44c1be4c5c752db9f895
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pepew(Copy 32).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SRBMiner.exeSRBMiner.exe --algorithm xelishashv2_pepew --pool stratum+tcp://na.mining4people.com:4176 --wallet PRnLRcurtkNtVx2MYeKrVUWWk9oRPLk4zM --password x --worker RiG33 --disable-gpu2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evbBC6B.tmp
evbBD66.tmp
evbBDA6.tmp
memory/396-39-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-4-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-3-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-7-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/396-16-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/396-23-0x0000000356B30000-0x0000000356DE3000-memory.dmp
memory/396-26-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-25-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/396-22-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-2-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-1-0x00007FFB47EAD000-0x00007FFB47EAE000-memory.dmp
memory/396-24-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-27-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-28-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-31-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-32-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-29-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-30-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-42-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-0-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-49-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-43-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-47-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-48-0x00007FFB47EAD000-0x00007FFB47EAE000-memory.dmp
memory/396-44-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-50-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-54-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-55-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-51-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-56-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp
memory/396-60-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-57-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-61-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-65-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-72-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-69-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-73-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-77-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-84-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-81-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-85-0x0000000140000000-0x0000000143207000-memory.dmp
memory/396-92-0x00000002E3650000-0x00000002E3666000-memory.dmp
memory/396-91-0x000000037C1A0000-0x000000037C231000-memory.dmp
memory/396-90-0x0000000356B30000-0x0000000356DE3000-memory.dmp