Analysis
- max time kernel
148s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/05/2024, 13:21
General
- Target miner 2.5555/miner 2.5/xmrig-6.21.3/xmrig.exe
- Size 6.1MB
- Sample240525-ql2fxaec95
- SHA256 e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\miner 2.5555\miner 2.5\xmrig-6.21.3\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\miner 2.5555\miner 2.5\xmrig-6.21.3\xmrig.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1708-0-0x0000025AB1E90000-0x0000025AB1EB0000-memory.dmp
memory/1708-1-0x0000025AB38D0000-0x0000025AB38F0000-memory.dmp
memory/1708-5-0x0000025B465E0000-0x0000025B46600000-memory.dmp
memory/1708-3-0x0000025B46180000-0x0000025B461A0000-memory.dmp
memory/1708-2-0x0000025AB38F0000-0x0000025AB3910000-memory.dmp
memory/1708-4-0x0000025B463B0000-0x0000025B463D0000-memory.dmp
memory/1708-8-0x0000025B46C70000-0x0000025B46C90000-memory.dmp
memory/1708-12-0x0000025B47750000-0x0000025B47770000-memory.dmp
memory/1708-11-0x0000025B47300000-0x0000025B47320000-memory.dmp
memory/1708-13-0x0000025B47770000-0x0000025B47790000-memory.dmp
memory/1708-10-0x0000025B472E0000-0x0000025B47300000-memory.dmp
memory/1708-9-0x0000025B470B0000-0x0000025B470D0000-memory.dmp
memory/1708-7-0x0000025B46C50000-0x0000025B46C70000-memory.dmp
memory/1708-6-0x0000025B46810000-0x0000025B46830000-memory.dmp
memory/1708-17-0x0000025B465E0000-0x0000025B46600000-memory.dmp
memory/1708-16-0x0000025B463B0000-0x0000025B463D0000-memory.dmp
memory/1708-15-0x0000025B46180000-0x0000025B461A0000-memory.dmp
memory/1708-14-0x0000025AB38F0000-0x0000025AB3910000-memory.dmp
memory/1708-20-0x0000025B46C70000-0x0000025B46C90000-memory.dmp
memory/1708-19-0x0000025B46C50000-0x0000025B46C70000-memory.dmp
memory/1708-18-0x0000025B46810000-0x0000025B46830000-memory.dmp
memory/1708-22-0x0000025B472E0000-0x0000025B47300000-memory.dmp
memory/1708-23-0x0000025B47300000-0x0000025B47320000-memory.dmp
memory/1708-21-0x0000025B470B0000-0x0000025B470D0000-memory.dmp
memory/1708-24-0x0000025B47750000-0x0000025B47770000-memory.dmp
memory/1708-25-0x0000025B47770000-0x0000025B47790000-memory.dmp