e12abacd392970ecd60e3ef32eaad5d17377b29be257ef2a2a1bd4cd2eda6176

Analysis

max time kernel
31s
max time network
148s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31-12-2022 23:24

Target

xmrig-6.18.1/pool_mine_example.cmd
Size

1KB
MD5

e7e82ca383d5c8db7d12f5770d04e2a3
SHA1

8e0f5111f4e0d95a606a0a434a03f15d6c118b04
SHA256

02ed7c9449e9f7c92709edc9e687e66c0e5ab012196eb90ef5071a2d698af62e
SHA512

40b14adab0f0d1374001e5d754f97e902c448190c3580b3a028f0ca1c16e52bc625292e85ee90a652dadda689c83877269962935b5d7382186c84a0df2fa50b8

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	620	xmrig.exe
Token: SeLockMemoryPrivilege	620	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
620	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 620	1636	cmd.exe	28
PID 1636 wrote to memory of 620	1636	cmd.exe	28
PID 1636 wrote to memory of 620	1636	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o pool.hashvault.pro:3333 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:620

memory/620-55-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/620-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/620-57-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download