c8717606af02a7a00c3b824b1f09b8fb03e770b5de0f34a7d5206ac83b44f6f2 | Triage

Analysis

max time kernel
48s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-01-2023 22:29

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/start.cmd
Size

122B
MD5

8ccdde4ddc436716f7e10bf95f107a0c
SHA1

c223527152e4ee6463a0ec0734feea0be091bbbb
SHA256

38da6bb54c7bab74c12d03a58e19e6645d43d1aaa9d9669a13cd677aff057729
SHA512

06375944c03ecd209e2d269bbaec1e1066d7dbe764b25ef1284885a2bdea00a3e21e9d2c841ca7803fd2a614680e9d0f0c8f997d1e7779fb322d05477d8e1c27

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1208	xmrig.exe
Token: SeLockMemoryPrivilege	1208	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1208	1268	cmd.exe	28
PID 1268 wrote to memory of 1208	1268	cmd.exe	28
PID 1268 wrote to memory of 1208	1268	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x8849ca58893802fc97d56eca36f0ebc10e46b97c.aleix -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-55-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download
memory/1208-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download