28df1f77952b8ae263f695b2d4d7c4551976b902e1be48baed720a45bb78adee

Analysis

max time kernel
1388s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 17:44

Target

xmrig-6.18.1/start.cmd
Size

113B
MD5

34af0052c5617f182798dee7c7e4e4e1
SHA1

b1359e72828cdddb87cdbdfa46e3a79f97cfddac
SHA256

c31ff3e6d1dc5f0555b4c4823205fb44ecd2a2b56a978bddcb33faceae024758
SHA512

00037ae09c97981302d95536a0cda03dc7e6e00fe84f60e14f037b69ef0a7ea68e2767afdd767ef002b7649aa366291e8841d793e29889a62e708c79c99c8c4c

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1500	xmrig.exe
Token: SeLockMemoryPrivilege	1500	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1500	4820	cmd.exe	81
PID 4820 wrote to memory of 1500	4820	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RMHmiB3nPeiynSRpiKyEPZGgWqvjK6JT7r.YKCG -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1500

memory/1500-133-0x00000264297B0000-0x00000264297D0000-memory.dmp

Filesize
128KB

Download
memory/1500-134-0x0000026429A00000-0x0000026429A20000-memory.dmp

Filesize
128KB

Download
memory/1500-135-0x0000026429A20000-0x0000026429A40000-memory.dmp

Filesize
128KB

Download
memory/1500-136-0x000002642B1F0000-0x000002642B210000-memory.dmp

Filesize
128KB

Download
memory/1500-137-0x0000026429A20000-0x0000026429A40000-memory.dmp

Filesize
128KB

Download
memory/1500-138-0x000002642B1F0000-0x000002642B210000-memory.dmp

Filesize
128KB

Download