f5bd0ebcfc01b3431f67795b918ea0220ec4204530a959b2c161afecf61b74aa

Analysis

max time kernel
117s
max time network
297s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 13:53 UTC

Target

miner 2.55555/miner 2.5/xmrig-6.21.3/pool_mine_example - Copy (5) - Copy.cmd
Size

1KB
MD5

bd2d455c1f3b2040bee33f2dfa8fe8a3
SHA1

14261b9c05af1f9a3ff7fdc160e997a82c586e9d
SHA256

23e5b645cd60421248984a0cdcc5b5eac3b59a1279787faf50df9475f998b156
SHA512

48d2825fb511f131d1165172721ce4288bb1632191425428bc2156e8c4fb9b38071f75b1048c25a4dd35d08c0d4def096f52ea7244273eb06177c531d51c6967

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2116	xmrig.exe
Token: SeLockMemoryPrivilege	2116	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2116	3048	cmd.exe	29
PID 3048 wrote to memory of 2116	3048	cmd.exe	29
PID 3048 wrote to memory of 2116	3048	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\miner 2.55555\miner 2.5\xmrig-6.21.3\pool_mine_example - Copy (5) - Copy.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\miner 2.55555\miner 2.5\xmrig-6.21.3\xmrig.exe
  xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2116

memory/2116-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/2116-1-0x0000000001DB0000-0x0000000001DD0000-memory.dmp

Filesize
128KB

Download
memory/2116-2-0x0000000001DD0000-0x0000000001DF0000-memory.dmp

Filesize
128KB

Download
memory/2116-4-0x0000000001DD0000-0x0000000001DF0000-memory.dmp

Filesize
128KB

Download
memory/2116-3-0x0000000001DB0000-0x0000000001DD0000-memory.dmp

Filesize
128KB

Download