9f5c8c12170dcc44f7c40113f21b0de7bd62a9ae129758014635cbf0f81777b7

Analysis

max time kernel
1800s
max time network
1778s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2023 14:43

Target

xmrig-6.18.1/start.cmd
Size

121B
MD5

f97515b6e88044088dcdb0e726910f52
SHA1

8be31b63c5a1bb462cb39b8b63db3053d7791a84
SHA256

31a64cc53d6cac06534063741ae2a11f22dc287ee2c773c2c24d678dc16491af
SHA512

732fcca9ab7135b4be4a5a8453420dc90c30db90db85aedd146675f71fe0cc2f25d3fd81394de8de0a0b736ec982a9725fa74c6d08cabaf05e641a3fa89f7a2d

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2148	xmrig.exe
Token: SeLockMemoryPrivilege	2148	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2148	2552	cmd.exe	82
PID 2552 wrote to memory of 2148	2552	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x3f86c6847b8ba1fb0e4b90e33dc1b6deb7e71278.YKCG -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2148

memory/2148-133-0x000002A5B1230000-0x000002A5B1250000-memory.dmp

Filesize
128KB

Download
memory/2148-134-0x000002A5B2C80000-0x000002A5B2CC0000-memory.dmp

Filesize
256KB

Download
memory/2148-135-0x000002A5B1280000-0x000002A5B12A0000-memory.dmp

Filesize
128KB

Download
memory/2148-136-0x000002A5B1530000-0x000002A5B1550000-memory.dmp

Filesize
128KB

Download
memory/2148-137-0x000002A5B1280000-0x000002A5B12A0000-memory.dmp

Filesize
128KB

Download
memory/2148-138-0x000002A5B1530000-0x000002A5B1550000-memory.dmp

Filesize
128KB

Download