9f5c8c12170dcc44f7c40113f21b0de7bd62a9ae129758014635cbf0f81777b7 | Triage

Analysis

max time kernel
1619s
max time network
1792s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-01-2023 07:26

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/start.cmd
Size

121B
MD5

f97515b6e88044088dcdb0e726910f52
SHA1

8be31b63c5a1bb462cb39b8b63db3053d7791a84
SHA256

31a64cc53d6cac06534063741ae2a11f22dc287ee2c773c2c24d678dc16491af
SHA512

732fcca9ab7135b4be4a5a8453420dc90c30db90db85aedd146675f71fe0cc2f25d3fd81394de8de0a0b736ec982a9725fa74c6d08cabaf05e641a3fa89f7a2d

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2008	xmrig.exe
Token: SeLockMemoryPrivilege	2008	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 2008	980	cmd.exe	29
PID 980 wrote to memory of 2008	980	cmd.exe	29
PID 980 wrote to memory of 2008	980	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x3f86c6847b8ba1fb0e4b90e33dc1b6deb7e71278.YKCG -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-55-0x0000000000300000-0x0000000000320000-memory.dmp

Filesize
128KB

Download
memory/2008-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/2008-57-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download