Overview
overview
5Static
static
3pepew(Copy 10).bat
windows7-x64
5pepew(Copy 11).bat
windows7-x64
5pepew(Copy 12).bat
windows7-x64
5pepew(Copy 13).bat
windows7-x64
5pepew(Copy 14).bat
windows7-x64
5pepew(Copy 15).bat
windows7-x64
5pepew(Copy 16).bat
windows7-x64
5pepew(Copy 17).bat
windows7-x64
5pepew(Copy 18).bat
windows7-x64
5pepew(Copy 19).bat
windows7-x64
5pepew(Copy 2).bat
windows7-x64
5pepew(Copy 20).bat
windows7-x64
5pepew(Copy 21).bat
windows7-x64
5pepew(Copy 22).bat
windows7-x64
5pepew(Copy 23).bat
windows7-x64
5pepew(Copy 24).bat
windows7-x64
5pepew(Copy 25).bat
windows7-x64
5pepew(Copy 26).bat
windows7-x64
5pepew(Copy 27).bat
windows7-x64
5pepew(Copy 28).bat
windows7-x64
5pepew(Copy 29).bat
windows7-x64
5pepew(Copy 3).bat
windows7-x64
pepew(Copy 30).bat
windows7-x64
5pepew(Copy 31).bat
windows7-x64
5pepew(Copy 32).bat
windows7-x64
pepew(Copy 4).bat
windows7-x64
5pepew(Copy 5).bat
windows7-x64
5pepew(Copy 6).bat
windows7-x64
5pepew(Copy 7).bat
windows7-x64
5pepew(Copy 8).bat
windows7-x64
5pepew(Copy 9).bat
windows7-x64
5pepew.bat
windows7-x64
5Analysis
-
max time kernel
1798s -
max time network
1802s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 06:33
Static task
static1
Behavioral task
behavioral1
Sample
pepew(Copy 10).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
pepew(Copy 11).bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral3
Sample
pepew(Copy 12).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
pepew(Copy 13).bat
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral5
Sample
pepew(Copy 14).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
pepew(Copy 15).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
pepew(Copy 16).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
pepew(Copy 17).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
pepew(Copy 18).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
pepew(Copy 19).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
pepew(Copy 2).bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
pepew(Copy 20).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
pepew(Copy 21).bat
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral14
Sample
pepew(Copy 22).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
pepew(Copy 23).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
pepew(Copy 24).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
pepew(Copy 25).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
pepew(Copy 26).bat
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral19
Sample
pepew(Copy 27).bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
pepew(Copy 28).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
pepew(Copy 29).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
pepew(Copy 3).bat
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
pepew(Copy 30).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
pepew(Copy 31).bat
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
pepew(Copy 32).bat
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
pepew(Copy 4).bat
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral27
Sample
pepew(Copy 5).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
pepew(Copy 6).bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral29
Sample
pepew(Copy 7).bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
pepew(Copy 8).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
pepew(Copy 9).bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
pepew.bat
Resource
win7-20240903-en
windows7-x64
General
-
Target
pepew(Copy 4).bat
-
Size
175B
-
MD5
b43d31908194f415bc9f5731578f2c20
-
SHA1
ff8fcc259f2ac3c315de0ca64afcc9180f7fa630
-
SHA256
0aa4b29b1a88d23e9adb298b134d16e51170a8ac1f1b722fbbe71dddc355d645
-
SHA512
b7e49eb27fe2c2eea2b008ab87a9bdd304e07f825913fab4021737a13d6f72d2e37e5d91168a6fd27b007a47e08b9e46cc7ed69e6cf511058631e73da432030b
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe 2052 SRBMiner.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 2052 SRBMiner.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2052 2220 cmd.exe 30 PID 2220 wrote to memory of 2052 2220 cmd.exe 30 PID 2220 wrote to memory of 2052 2220 cmd.exe 30 PID 2052 wrote to memory of 1664 2052 SRBMiner.exe 31 PID 2052 wrote to memory of 1664 2052 SRBMiner.exe 31 PID 2052 wrote to memory of 1664 2052 SRBMiner.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\pepew(Copy 4).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\SRBMiner.exeSRBMiner.exe --algorithm xelishashv2_pepew --pool stratum+tcp://na.mining4people.com:4176 --wallet PRnLRcurtkNtVx2MYeKrVUWWk9oRPLk4zM --password x --worker RiG4 --disable-gpu2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵PID:1664
-
-