Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-01-2023 02:43

General

  • Target

    xmrig-6.18.1/benchmark_10M.cmd

  • Size

    56B

  • MD5

    14b1ce42ded2df03638180864e4d056f

  • SHA1

    cbc1b3edd1942630f6363f3ccae574283b14c260

  • SHA256

    bdec0d2ea20decc25659f26c7bfd7a78fb0e51cc100443b8a35c43206d2eb86a

  • SHA512

    d8297c2728245b570ad71b8062a17e28e2d9e72bf8be773bb92828e57912cdd0a6ec35fe244069a5fdaf3be8cfe3997c403ea551b81be5708dd80c6eb5f6e458

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\benchmark_10M.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
      xmrig.exe --bench=10M --submit
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1680-133-0x000002D548560000-0x000002D548580000-memory.dmp

    Filesize

    128KB

  • memory/1680-134-0x000002D548780000-0x000002D5487C0000-memory.dmp

    Filesize

    256KB

  • memory/1680-135-0x000002D5487C0000-0x000002D5487E0000-memory.dmp

    Filesize

    128KB

  • memory/1680-136-0x000002D5487E0000-0x000002D548800000-memory.dmp

    Filesize

    128KB

  • memory/1680-138-0x000002D5487E0000-0x000002D548800000-memory.dmp

    Filesize

    128KB

  • memory/1680-137-0x000002D5487C0000-0x000002D5487E0000-memory.dmp

    Filesize

    128KB