437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9 | Triage

Analysis

max time kernel
129s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2023 02:44

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/rtm_ghostrider_example.cmd
Size

1KB
MD5

9b7762432e3ab03dc49b1989ec7b8d1c
SHA1

ac7f0df988b00f665e29c6204866d8ba4cc18b5f
SHA256

bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
SHA512

920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4792	xmrig.exe
Token: SeLockMemoryPrivilege	4792	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4792	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4792	4876	cmd.exe	82
PID 4876 wrote to memory of 4792	4876	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4792-133-0x0000012D85F20000-0x0000012D85F40000-memory.dmp

Filesize
128KB

Download