IOC Report
CryptoMiner.exe

CryptoMiner.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\filename.exe

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\fname.exe

PE32 executable (console) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\CryptoMiner.exe

"C:\Users\user\Desktop\CryptoMiner.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\user\AppData\Local\Temp\fname.exe

"C:\Users\user\AppData\Local\Temp\fname.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Users\user\AppData\Local\Temp\filename.exe

"C:\Users\user\AppData\Local\Temp\filename.exe"

C:\Windows\System32\cmd.exe

"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit

http://45.9.20.31/rigx.exe

45.9.20.31

http://45.9.20.31/asdasdasd.exe

45.9.20.31

65.21.213.209

unknown

United States