9f5c8c12170dcc44f7c40113f21b0de7bd62a9ae129758014635cbf0f81777b7

Analysis

max time kernel
1403s
max time network
1794s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2023 07:26

Target

xmrig-6.18.1/start.cmd
Size

121B
MD5

f97515b6e88044088dcdb0e726910f52
SHA1

8be31b63c5a1bb462cb39b8b63db3053d7791a84
SHA256

31a64cc53d6cac06534063741ae2a11f22dc287ee2c773c2c24d678dc16491af
SHA512

732fcca9ab7135b4be4a5a8453420dc90c30db90db85aedd146675f71fe0cc2f25d3fd81394de8de0a0b736ec982a9725fa74c6d08cabaf05e641a3fa89f7a2d

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1172	xmrig.exe
Token: SeLockMemoryPrivilege	1172	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1172	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1172	2848	cmd.exe	80
PID 2848 wrote to memory of 1172	2848	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x3f86c6847b8ba1fb0e4b90e33dc1b6deb7e71278.YKCG -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1172

memory/1172-133-0x000001A73E040000-0x000001A73E060000-memory.dmp

Filesize
128KB

Download
memory/1172-134-0x000001A73FA40000-0x000001A73FA80000-memory.dmp

Filesize
256KB

Download
memory/1172-135-0x000001A73FAA0000-0x000001A73FAC0000-memory.dmp

Filesize
128KB

Download
memory/1172-136-0x000001A73FA80000-0x000001A73FAA0000-memory.dmp

Filesize
128KB

Download
memory/1172-137-0x000001A73FAA0000-0x000001A73FAC0000-memory.dmp

Filesize
128KB

Download
memory/1172-138-0x000001A73FA80000-0x000001A73FAA0000-memory.dmp

Filesize
128KB

Download