2e55752a5ce424f78521951780658ea572e78920fab1980c5047eb543d3dbec8 | Triage

Analysis

max time kernel
1792s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 19:16

Sharing

Report Analysis Logs

General

Target

SysApps/rtm_ghostrider_example.cmd
Size

1KB
MD5

9b7762432e3ab03dc49b1989ec7b8d1c
SHA1

ac7f0df988b00f665e29c6204866d8ba4cc18b5f
SHA256

bfcef8b9791893a58f4a999190e83d8426a6d1be6b7ee9ccd8bd06f5e55d314d
SHA512

920f6c7cb3f95c82ec7a97314166c7a7165ee4d6d658c70d64f6528515dd7b10e9d0c28f91fa958b47663d854fa8037ec2ca8368e7d550f5f2c49a16504ffa88

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1972	xmrig.exe
Token: SeLockMemoryPrivilege	1972	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1972	4824	cmd.exe	81
PID 4824 wrote to memory of 1972	4824	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SysApps\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\SysApps\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-133-0x0000018CAC130000-0x0000018CAC150000-memory.dmp

Filesize
128KB

Download