437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9

Analysis

max time kernel
53s
max time network
140s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 02:44

Target

xmrig-6.18.1/pool_mine_example.cmd
Size

1KB
MD5

e7e82ca383d5c8db7d12f5770d04e2a3
SHA1

8e0f5111f4e0d95a606a0a434a03f15d6c118b04
SHA256

02ed7c9449e9f7c92709edc9e687e66c0e5ab012196eb90ef5071a2d698af62e
SHA512

40b14adab0f0d1374001e5d754f97e902c448190c3580b3a028f0ca1c16e52bc625292e85ee90a652dadda689c83877269962935b5d7382186c84a0df2fa50b8

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1616	xmrig.exe
Token: SeLockMemoryPrivilege	1616	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1616	1356	cmd.exe	29
PID 1356 wrote to memory of 1616	1356	cmd.exe	29
PID 1356 wrote to memory of 1616	1356	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o pool.hashvault.pro:3333 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1616

memory/1616-55-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/1616-56-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download