9f5c8c12170dcc44f7c40113f21b0de7bd62a9ae129758014635cbf0f81777b7 | Triage

Analysis

max time kernel
1792s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2023 07:26

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/rtm_ghostrider_example.cmd
Size

1KB
MD5

9b7762432e3ab03dc49b1989ec7b8d1c
SHA1

ac7f0df988b00f665e29c6204866d8ba4cc18b5f
SHA256

bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
SHA512

920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4716	xmrig.exe
Token: SeLockMemoryPrivilege	4716	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4716	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4716	2760	cmd.exe	83
PID 2760 wrote to memory of 4716	2760	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4716-133-0x000001C927F20000-0x000001C927F40000-memory.dmp

Filesize
128KB

Download