397f23f90c8445ca761c20957cc771c48c07f012a114bdedeb987b9fcd70fcb0 | Triage

Analysis

max time kernel
1633s
max time network
1795s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-01-2023 18:09

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/start.cmd
Size

125B
MD5

e979eb7b51bd0a2ac0a5eedf283aa8e0
SHA1

be0114bc75fbc6f7f2b5664532acd9dc92c56785
SHA256

67eea252e6b86e6be226f6b30a54697149280400e15deb43838cdad7d51a9c28
SHA512

879d2524a2d6919cae321c7496cccc969597bc20e710411def438d0f19d83c755e29f7fec5177a948c32d11c43aa6f1e9239b163e6140863150019205652e541

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1776	xmrig.exe
Token: SeLockMemoryPrivilege	1776	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1776	1940	cmd.exe	28
PID 1940 wrote to memory of 1776	1940	cmd.exe	28
PID 1940 wrote to memory of 1776	1940	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x8aaf646ad9fae761cd19adeb73a368ddee3be993.Estonges -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download