437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9 | Triage

Analysis

max time kernel
134s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 02:44

Sharing

Report Analysis Logs

General

Target

xmrig-6.18.1/rtm_ghostrider_example.cmd
Size

1KB
MD5

9b7762432e3ab03dc49b1989ec7b8d1c
SHA1

ac7f0df988b00f665e29c6204866d8ba4cc18b5f
SHA256

bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
SHA512

920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1648	xmrig.exe
Token: SeLockMemoryPrivilege	1648	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1648	1632	cmd.exe	29
PID 1632 wrote to memory of 1648	1632	cmd.exe	29
PID 1632 wrote to memory of 1648	1632	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-55-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download