Analysis
- max time kernel
1384s - max time network
1796s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
01/01/2023, 18:09
General
- Target xmrig-6.18.1/start.cmd
- Size 125B
- Sample230101-wrkm8scd35
- SHA256 67eea252e6b86e6be226f6b30a54697149280400e15deb43838cdad7d51a9c28
Score
1/10
Malware Config
Signatures
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exexmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x8aaf646ad9fae761cd19adeb73a368ddee3be993.Estonges -p x2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2384-133-0x000002501C900000-0x000002501C920000-memory.dmp
memory/2384-134-0x000002501C950000-0x000002501C990000-memory.dmp
memory/2384-135-0x000002501C990000-0x000002501C9B0000-memory.dmp
memory/2384-136-0x000002501C9B0000-0x000002501C9D0000-memory.dmp
memory/2384-137-0x000002501C990000-0x000002501C9B0000-memory.dmp
memory/2384-138-0x000002501C9B0000-0x000002501C9D0000-memory.dmp