397f23f90c8445ca761c20957cc771c48c07f012a114bdedeb987b9fcd70fcb0

Analysis

max time kernel
1619s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2023, 18:10

Target

xmrig-6.18.1/start.cmd
Size

125B
MD5

e979eb7b51bd0a2ac0a5eedf283aa8e0
SHA1

be0114bc75fbc6f7f2b5664532acd9dc92c56785
SHA256

67eea252e6b86e6be226f6b30a54697149280400e15deb43838cdad7d51a9c28
SHA512

879d2524a2d6919cae321c7496cccc969597bc20e710411def438d0f19d83c755e29f7fec5177a948c32d11c43aa6f1e9239b163e6140863150019205652e541

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4820	xmrig.exe
Token: SeLockMemoryPrivilege	4820	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4820	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4820	4264	cmd.exe	83
PID 4264 wrote to memory of 4820	4264	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x8aaf646ad9fae761cd19adeb73a368ddee3be993.Estonges -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4820

memory/4820-133-0x00000187C1640000-0x00000187C1660000-memory.dmp

Filesize
128KB

Download
memory/4820-134-0x00000187C1690000-0x00000187C16D0000-memory.dmp

Filesize
256KB

Download
memory/4820-135-0x00000187C3080000-0x00000187C30A0000-memory.dmp

Filesize
128KB

Download
memory/4820-136-0x00000187C30A0000-0x00000187C30C0000-memory.dmp

Filesize
128KB

Download
memory/4820-137-0x00000187C3080000-0x00000187C30A0000-memory.dmp

Filesize
128KB

Download
memory/4820-138-0x00000187C30A0000-0x00000187C30C0000-memory.dmp

Filesize
128KB

Download