c8717606af02a7a00c3b824b1f09b8fb03e770b5de0f34a7d5206ac83b44f6f2

Analysis

max time kernel
1404s
max time network
1791s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2023 04:41

Target

xmrig-6.18.1/start.cmd
Size

122B
MD5

8ccdde4ddc436716f7e10bf95f107a0c
SHA1

c223527152e4ee6463a0ec0734feea0be091bbbb
SHA256

38da6bb54c7bab74c12d03a58e19e6645d43d1aaa9d9669a13cd677aff057729
SHA512

06375944c03ecd209e2d269bbaec1e1066d7dbe764b25ef1284885a2bdea00a3e21e9d2c841ca7803fd2a614680e9d0f0c8f997d1e7779fb322d05477d8e1c27

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4960	xmrig.exe
Token: SeLockMemoryPrivilege	4960	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4960	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4960	3848	cmd.exe	82
PID 3848 wrote to memory of 4960	3848	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x8849ca58893802fc97d56eca36f0ebc10e46b97c.aleix -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4960

memory/4960-132-0x0000000000000000-mapping.dmp

Download
memory/4960-133-0x000001FB26DA0000-0x000001FB26DC0000-memory.dmp

Filesize
128KB

Download
memory/4960-134-0x000001FB26FC0000-0x000001FB27000000-memory.dmp

Filesize
256KB

Download
memory/4960-135-0x000001FB27000000-0x000001FB27020000-memory.dmp

Filesize
128KB

Download
memory/4960-136-0x000001FB288E0000-0x000001FB28900000-memory.dmp

Filesize
128KB

Download
memory/4960-137-0x000001FB27000000-0x000001FB27020000-memory.dmp

Filesize
128KB

Download
memory/4960-138-0x000001FB288E0000-0x000001FB28900000-memory.dmp

Filesize
128KB

Download