e12abacd392970ecd60e3ef32eaad5d17377b29be257ef2a2a1bd4cd2eda6176 | Triage

Analysis

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-12-2022 23:24

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/rtm_ghostrider_example.cmd
Size

1KB
MD5

9b7762432e3ab03dc49b1989ec7b8d1c
SHA1

ac7f0df988b00f665e29c6204866d8ba4cc18b5f
SHA256

bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
SHA512

920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1640	xmrig.exe
Token: SeLockMemoryPrivilege	1640	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1640	1428	cmd.exe	28
PID 1428 wrote to memory of 1640	1428	cmd.exe	28
PID 1428 wrote to memory of 1640	1428	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-55-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download