28df1f77952b8ae263f695b2d4d7c4551976b902e1be48baed720a45bb78adee

Analysis

max time kernel
1407s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 15:42

Target

xmrig-6.18.1/start.cmd
Size

113B
MD5

34af0052c5617f182798dee7c7e4e4e1
SHA1

b1359e72828cdddb87cdbdfa46e3a79f97cfddac
SHA256

c31ff3e6d1dc5f0555b4c4823205fb44ecd2a2b56a978bddcb33faceae024758
SHA512

00037ae09c97981302d95536a0cda03dc7e6e00fe84f60e14f037b69ef0a7ea68e2767afdd767ef002b7649aa366291e8841d793e29889a62e708c79c99c8c4c

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2688	xmrig.exe
Token: SeLockMemoryPrivilege	2688	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2688	1208	cmd.exe	82
PID 1208 wrote to memory of 2688	1208	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RMHmiB3nPeiynSRpiKyEPZGgWqvjK6JT7r.YKCG -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2688

memory/2688-133-0x000001096D420000-0x000001096D440000-memory.dmp

Filesize
128KB

Download
memory/2688-134-0x000001096EF10000-0x000001096EF50000-memory.dmp

Filesize
256KB

Download
memory/2688-135-0x000001096EF50000-0x000001096EF70000-memory.dmp

Filesize
128KB

Download
memory/2688-136-0x000001096EF70000-0x000001096EF90000-memory.dmp

Filesize
128KB

Download
memory/2688-137-0x000001096EF50000-0x000001096EF70000-memory.dmp

Filesize
128KB

Download
memory/2688-138-0x000001096EF70000-0x000001096EF90000-memory.dmp

Filesize
128KB

Download