Overview
overview
10Static
static
10xmrig-6.18...64.exe
windows7-x64
xmrig-6.18...64.exe
windows10-2004-x64
xmrig-6.18...0M.cmd
windows7-x64
1xmrig-6.18...0M.cmd
windows10-2004-x64
1xmrig-6.18...1M.cmd
windows7-x64
1xmrig-6.18...1M.cmd
windows10-2004-x64
1xmrig-6.18...le.cmd
windows7-x64
1xmrig-6.18...le.cmd
windows10-2004-x64
1xmrig-6.18...le.cmd
windows7-x64
1xmrig-6.18...le.cmd
windows10-2004-x64
1xmrig-6.18...le.cmd
windows7-x64
1xmrig-6.18...le.cmd
windows10-2004-x64
1xmrig-6.18...rt.cmd
windows7-x64
1xmrig-6.18...rt.cmd
windows10-2004-x64
1xmrig-6.18...ig.exe
windows7-x64
1xmrig-6.18...ig.exe
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-01-2023 02:44
Behavioral task
behavioral1
Sample
xmrig-6.18.1/WinRing0x64.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
xmrig-6.18.1/WinRing0x64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
xmrig-6.18.1/benchmark_10M.cmd
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
xmrig-6.18.1/benchmark_10M.cmd
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
xmrig-6.18.1/benchmark_1M.cmd
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
xmrig-6.18.1/benchmark_1M.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
xmrig-6.18.1/pool_mine_example.cmd
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
xmrig-6.18.1/pool_mine_example.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
xmrig-6.18.1/rtm_ghostrider_example.cmd
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
xmrig-6.18.1/rtm_ghostrider_example.cmd
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
xmrig-6.18.1/solo_mine_example.cmd
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
xmrig-6.18.1/solo_mine_example.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
xmrig-6.18.1/start.cmd
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
xmrig-6.18.1/start.cmd
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
xmrig-6.18.1/xmrig.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
xmrig-6.18.1/xmrig.exe
Resource
win10v2004-20221111-en
General
-
Target
xmrig-6.18.1/rtm_ghostrider_example.cmd
-
Size
1KB
-
MD5
9b7762432e3ab03dc49b1989ec7b8d1c
-
SHA1
ac7f0df988b00f665e29c6204866d8ba4cc18b5f
-
SHA256
bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
-
SHA512
920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 972 xmrig.exe Token: SeLockMemoryPrivilege 972 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 972 xmrig.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2004 wrote to memory of 972 2004 cmd.exe 29 PID 2004 wrote to memory of 972 2004 cmd.exe 29 PID 2004 wrote to memory of 972 2004 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\rtm_ghostrider_example.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exexmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:972
-
Network
-
Remote address:8.8.8.8:53Requestraptoreumemporium.comIN AResponseraptoreumemporium.comIN A172.14.53.224
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3