437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9 | Triage

Analysis

max time kernel
1627s
max time network
1796s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 02:43

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/start.cmd
Size

120B
MD5

e119ea1e6088ba1d8f43a69cc25844e7
SHA1

889f803c8b978669695b79981ecb4acc4755a965
SHA256

5939b205a4f562e8535faca81188258e61ce6b793780c0ea86404007b7ad71fa
SHA512

43a05c24f1c5293374e981ee62d44e1b448919783a1da72ad9a6751b308b5f2d6e0e32068f5f8341b940fe08cdffcb87a05a27538417be4a4633f43a0deb9913

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1628	xmrig.exe
Token: SeLockMemoryPrivilege	1628	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1628	2008	cmd.exe	28
PID 2008 wrote to memory of 1628	2008	cmd.exe	28
PID 2008 wrote to memory of 1628	2008	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0xbceb9d436a9ce9cae8904b876e4c243b45b44f31.jay -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-55-0x00000000003F0000-0x0000000000410000-memory.dmp

Filesize
128KB

Download
memory/1628-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/1628-57-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download