c562f42bbb7db6bbeef806e668d0ae8a19634c9887a73314889547c4b1e19bf1

Resubmissions

22/07/2026, 22:03

260722-1yjrqs1xes

22/07/2026, 22:01

260722-1xp75acf535

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ETC+ALPH.bat
Size 277B
Sample260722-1xp75acf53
SHA256 c562f42bbb7db6bbeef806e668d0ae8a19634c9887a73314889547c4b1e19bf1
MD5 ee6547a93a2e68fb3754f3d3f5de7b8f
SHA1 6fa75502d75e7f766f4981acb57d861a4b8f82a1
SHA512 2a3ff6109e1b65b5064491ca135ab51b5d7135ebf7dfdc57a053ff5acb59ba98b0157c90afc59fbb53b10d67a9988e9c290d1a693fc9654b7e5e9d2b3882addc
TLSH
T12AD02B5EDF74177AF4DD0904B59B3C0CC90C1546F66A8E045D3C4725F5050ECAD340CA
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5016	t-rex.exe
5016	t-rex.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2412	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	t-rex.exe
5016	t-rex.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 5016	2412	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ETC+ALPH.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\t-rex.exe
  t-rex.exe -a etchash --dual-algo blake3 -o stratum+tcp://etc.2miners.com:1010 -u 0x0924EF9ecBcC1287047cAFd2EAD3A133313eE6A2 -p x -w rig0 --url2 stratum+tcp://de.alephium.herominers.com:1199 --user2 1qUuxVuXN2Pk4nnYTbL4qihjLWyRkVMQVYQDAajCcuPq --pass2 x
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-0-0x00007FFD46490000-0x00007FFD46492000-memory.dmp

Download

memory/5016-2-0x00007FFD464A0000-0x00007FFD464A2000-memory.dmp

Download