Analysis Overview
SHA256
3dda13d5f9e6b209fb76c69c25e9013797cc207e38ce3764c829947fc146c779
Threat Level: Known bad
The file OLD.rar was found to be: Known bad.
Malicious Activity Summary
XMRig Miner payload
Xmrig family
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-26 10:59
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xmrig family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral16
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:07
Platform
win10v2004-20240508-en
Max time kernel
1710s
Max time network
1797s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2716 wrote to memory of 3640 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2716 wrote to memory of 3640 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.72.42.20.in-addr.arpa | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
Files
memory/3640-0-0x00000258EEE90000-0x00000258EEEB0000-memory.dmp
memory/3640-1-0x00000258EEEE0000-0x00000258EEF00000-memory.dmp
memory/3640-3-0x00000258EEF20000-0x00000258EEF40000-memory.dmp
memory/3640-2-0x00000258EEF00000-0x00000258EEF20000-memory.dmp
memory/3640-5-0x00000258EEF20000-0x00000258EEF40000-memory.dmp
memory/3640-4-0x00000258EEF00000-0x00000258EEF20000-memory.dmp
Analysis: behavioral5
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:45
Platform
win7-20240419-en
Max time kernel
1563s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3000 wrote to memory of 2016 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 3000 wrote to memory of 2016 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 3000 wrote to memory of 2016 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2016-0-0x00000000002F0000-0x0000000000310000-memory.dmp
memory/2016-2-0x0000000002140000-0x0000000002160000-memory.dmp
memory/2016-1-0x0000000002120000-0x0000000002140000-memory.dmp
memory/2016-4-0x0000000002140000-0x0000000002160000-memory.dmp
memory/2016-3-0x0000000002120000-0x0000000002140000-memory.dmp
Analysis: behavioral6
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:50
Platform
win10v2004-20240508-en
Max time kernel
1347s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1128 wrote to memory of 2204 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1128 wrote to memory of 2204 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.239.69.13.in-addr.arpa | udp |
Files
memory/2204-0-0x000001BE7E8C0000-0x000001BE7E8E0000-memory.dmp
memory/2204-1-0x000001BE7E910000-0x000001BE7E930000-memory.dmp
memory/2204-2-0x000001BE7E930000-0x000001BE7E950000-memory.dmp
memory/2204-3-0x000001BE7E950000-0x000001BE7E970000-memory.dmp
memory/2204-4-0x000001BE7E930000-0x000001BE7E950000-memory.dmp
memory/2204-5-0x000001BE7E950000-0x000001BE7E970000-memory.dmp
Analysis: behavioral9
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:56
Platform
win7-20231129-en
Max time kernel
1563s
Max time network
1786s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1600 wrote to memory of 2196 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1600 wrote to memory of 2196 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1600 wrote to memory of 2196 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2196-0-0x0000000001BA0000-0x0000000001BC0000-memory.dmp
memory/2196-2-0x00000000024A0000-0x00000000024C0000-memory.dmp
memory/2196-1-0x0000000002040000-0x0000000002060000-memory.dmp
memory/2196-4-0x00000000024A0000-0x00000000024C0000-memory.dmp
memory/2196-3-0x0000000002040000-0x0000000002060000-memory.dmp
Analysis: behavioral22
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:12
Platform
win10v2004-20240508-en
Max time kernel
1393s
Max time network
1786s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2680 wrote to memory of 1204 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2680 wrote to memory of 1204 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| BE | 2.17.107.105:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.173.189.20.in-addr.arpa | udp |
Files
memory/1204-0-0x0000024CF2C40000-0x0000024CF2C60000-memory.dmp
memory/1204-1-0x0000024CF4540000-0x0000024CF4560000-memory.dmp
memory/1204-3-0x0000024CF4580000-0x0000024CF45A0000-memory.dmp
memory/1204-2-0x0000024CF4560000-0x0000024CF4580000-memory.dmp
memory/1204-4-0x0000024CF4560000-0x0000024CF4580000-memory.dmp
memory/1204-5-0x0000024CF4580000-0x0000024CF45A0000-memory.dmp
Analysis: behavioral23
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:12
Platform
win7-20240221-en
Max time kernel
1562s
Max time network
1788s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2084 wrote to memory of 2316 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2084 wrote to memory of 2316 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2084 wrote to memory of 2316 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2316-0-0x00000000000F0000-0x0000000000110000-memory.dmp
memory/2316-2-0x0000000000310000-0x0000000000330000-memory.dmp
memory/2316-1-0x00000000002F0000-0x0000000000310000-memory.dmp
memory/2316-4-0x0000000000310000-0x0000000000330000-memory.dmp
memory/2316-3-0x00000000002F0000-0x0000000000310000-memory.dmp
Analysis: behavioral26
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:17
Platform
win10v2004-20240508-en
Max time kernel
1351s
Max time network
1797s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4524 wrote to memory of 752 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 4524 wrote to memory of 752 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5.173.189.20.in-addr.arpa | udp |
Files
memory/752-0-0x0000022B82A50000-0x0000022B82A70000-memory.dmp
memory/752-1-0x0000022B82AA0000-0x0000022B82AC0000-memory.dmp
memory/752-2-0x0000022B82AC0000-0x0000022B82AE0000-memory.dmp
memory/752-3-0x0000022B82AE0000-0x0000022B82B00000-memory.dmp
memory/752-5-0x0000022B82AE0000-0x0000022B82B00000-memory.dmp
memory/752-4-0x0000022B82AC0000-0x0000022B82AE0000-memory.dmp
Analysis: behavioral31
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:24
Platform
win7-20240221-en
Max time kernel
1556s
Max time network
1792s
Command Line
Signatures
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2212 wrote to memory of 2948 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2212 wrote to memory of 2948 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2212 wrote to memory of 2948 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2948-0-0x0000000000200000-0x0000000000220000-memory.dmp
memory/2948-2-0x0000000000540000-0x0000000000560000-memory.dmp
memory/2948-1-0x00000000002B0000-0x00000000002D0000-memory.dmp
memory/2948-4-0x0000000000540000-0x0000000000560000-memory.dmp
memory/2948-3-0x00000000002B0000-0x00000000002D0000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:36
Platform
win7-20240508-en
Max time kernel
1558s
Max time network
1796s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1704 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1704 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1704 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2056-0-0x00000000002F0000-0x0000000000310000-memory.dmp
memory/2056-2-0x00000000005F0000-0x0000000000610000-memory.dmp
memory/2056-1-0x00000000005D0000-0x00000000005F0000-memory.dmp
memory/2056-4-0x00000000005F0000-0x0000000000610000-memory.dmp
memory/2056-3-0x00000000005D0000-0x00000000005F0000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:40
Platform
win7-20240221-en
Max time kernel
1558s
Max time network
1799s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2864 wrote to memory of 1280 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2864 wrote to memory of 1280 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2864 wrote to memory of 1280 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/1280-0-0x00000000000F0000-0x0000000000110000-memory.dmp
memory/1280-2-0x0000000000580000-0x00000000005A0000-memory.dmp
memory/1280-1-0x0000000000560000-0x0000000000580000-memory.dmp
memory/1280-4-0x0000000000580000-0x00000000005A0000-memory.dmp
memory/1280-3-0x0000000000560000-0x0000000000580000-memory.dmp
Analysis: behavioral11
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:56
Platform
win7-20240215-en
Max time kernel
1558s
Max time network
1800s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1932 wrote to memory of 2940 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1932 wrote to memory of 2940 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1932 wrote to memory of 2940 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2940-0-0x00000000000F0000-0x0000000000110000-memory.dmp
memory/2940-2-0x00000000005F0000-0x0000000000610000-memory.dmp
memory/2940-1-0x0000000000390000-0x00000000003B0000-memory.dmp
memory/2940-4-0x00000000005F0000-0x0000000000610000-memory.dmp
memory/2940-3-0x0000000000390000-0x00000000003B0000-memory.dmp
Analysis: behavioral32
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:25
Platform
win10v2004-20240508-en
Max time kernel
1794s
Max time network
1800s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3764 wrote to memory of 1200 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 3764 wrote to memory of 1200 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4144,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.10.44.20.in-addr.arpa | udp |
Files
memory/1200-0-0x000001CA85410000-0x000001CA85430000-memory.dmp
memory/1200-1-0x000001CA86D50000-0x000001CA86D70000-memory.dmp
memory/1200-2-0x000001CA86D70000-0x000001CA86D90000-memory.dmp
memory/1200-3-0x000001CB19500000-0x000001CB19520000-memory.dmp
memory/1200-4-0x000001CA86D70000-0x000001CA86D90000-memory.dmp
memory/1200-5-0x000001CB19500000-0x000001CB19520000-memory.dmp
Analysis: behavioral27
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:18
Platform
win7-20231129-en
Max time kernel
1561s
Max time network
1789s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1372 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1372 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1372 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2988-0-0x00000000002F0000-0x0000000000310000-memory.dmp
memory/2988-2-0x00000000025A0000-0x00000000025C0000-memory.dmp
memory/2988-1-0x0000000002580000-0x00000000025A0000-memory.dmp
memory/2988-4-0x00000000025A0000-0x00000000025C0000-memory.dmp
memory/2988-3-0x0000000002580000-0x00000000025A0000-memory.dmp
Analysis: behavioral10
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:56
Platform
win10v2004-20240226-en
Max time kernel
1793s
Max time network
1803s
Command Line
Signatures
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3364 wrote to memory of 4208 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 3364 wrote to memory of 4208 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4208 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| FR | 172.217.20.202:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 202.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.179.89.13.in-addr.arpa | udp |
Files
memory/4208-0-0x0000027D03FE0000-0x0000027D04000000-memory.dmp
memory/4208-1-0x0000027D04140000-0x0000027D04160000-memory.dmp
memory/4208-3-0x0000027D04180000-0x0000027D041A0000-memory.dmp
memory/4208-2-0x0000027D04160000-0x0000027D04180000-memory.dmp
memory/4208-5-0x0000027D04180000-0x0000027D041A0000-memory.dmp
memory/4208-4-0x0000027D04160000-0x0000027D04180000-memory.dmp
Analysis: behavioral17
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:07
Platform
win7-20240221-en
Max time kernel
1558s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2180 wrote to memory of 2996 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2180 wrote to memory of 2996 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2180 wrote to memory of 2996 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2996-0-0x0000000000080000-0x00000000000A0000-memory.dmp
memory/2996-2-0x0000000002190000-0x00000000021B0000-memory.dmp
memory/2996-1-0x0000000000520000-0x0000000000540000-memory.dmp
memory/2996-4-0x0000000002190000-0x00000000021B0000-memory.dmp
memory/2996-3-0x0000000000520000-0x0000000000540000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:52
Platform
win7-20240419-en
Max time kernel
1566s
Max time network
1788s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1148 wrote to memory of 2268 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1148 wrote to memory of 2268 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1148 wrote to memory of 2268 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2268-0-0x00000000002F0000-0x0000000000310000-memory.dmp
memory/2268-2-0x00000000005D0000-0x00000000005F0000-memory.dmp
memory/2268-1-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2268-4-0x00000000005D0000-0x00000000005F0000-memory.dmp
memory/2268-3-0x00000000005B0000-0x00000000005D0000-memory.dmp
Analysis: behavioral19
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:09
Platform
win7-20240508-en
Max time kernel
1565s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1608 wrote to memory of 3036 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1608 wrote to memory of 3036 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1608 wrote to memory of 3036 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/3036-0-0x0000000000300000-0x0000000000320000-memory.dmp
memory/3036-2-0x0000000002720000-0x0000000002740000-memory.dmp
memory/3036-1-0x0000000002600000-0x0000000002620000-memory.dmp
memory/3036-4-0x0000000002720000-0x0000000002740000-memory.dmp
memory/3036-3-0x0000000002600000-0x0000000002620000-memory.dmp
Analysis: behavioral24
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:15
Platform
win10v2004-20240426-en
Max time kernel
1353s
Max time network
1788s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1804 wrote to memory of 3436 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1804 wrote to memory of 3436 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.15.104.51.in-addr.arpa | udp |
Files
memory/3436-0-0x0000013A9FD20000-0x0000013A9FD40000-memory.dmp
memory/3436-1-0x0000013AA1720000-0x0000013AA1740000-memory.dmp
memory/3436-2-0x0000013AA1740000-0x0000013AA1760000-memory.dmp
memory/3436-3-0x0000013AA1760000-0x0000013AA1780000-memory.dmp
memory/3436-5-0x0000013AA1760000-0x0000013AA1780000-memory.dmp
memory/3436-4-0x0000013AA1740000-0x0000013AA1760000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:43
Platform
win10v2004-20240508-en
Max time kernel
1706s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1332 wrote to memory of 4020 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1332 wrote to memory of 4020 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.98.74.40.in-addr.arpa | udp |
Files
memory/4020-0-0x0000020990760000-0x0000020990780000-memory.dmp
memory/4020-1-0x00000209920A0000-0x00000209920C0000-memory.dmp
memory/4020-3-0x00000209920E0000-0x0000020992100000-memory.dmp
memory/4020-2-0x00000209920C0000-0x00000209920E0000-memory.dmp
memory/4020-4-0x00000209920C0000-0x00000209920E0000-memory.dmp
memory/4020-5-0x00000209920E0000-0x0000020992100000-memory.dmp
Analysis: behavioral14
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:03
Platform
win10v2004-20240508-en
Max time kernel
1794s
Max time network
1799s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1764 wrote to memory of 1200 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1764 wrote to memory of 1200 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.10.44.20.in-addr.arpa | udp |
Files
memory/1200-0-0x000001389AFF0000-0x000001389B010000-memory.dmp
memory/1200-1-0x000001389B140000-0x000001389B160000-memory.dmp
memory/1200-3-0x000001392D7F0000-0x000001392D810000-memory.dmp
memory/1200-2-0x000001389B160000-0x000001389B180000-memory.dmp
memory/1200-5-0x000001392D7F0000-0x000001392D810000-memory.dmp
memory/1200-4-0x000001389B160000-0x000001389B180000-memory.dmp
Analysis: behavioral28
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:18
Platform
win10v2004-20240426-en
Max time kernel
1344s
Max time network
1798s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1060 wrote to memory of 1008 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1060 wrote to memory of 1008 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
Files
memory/1008-0-0x000002104E230000-0x000002104E250000-memory.dmp
memory/1008-1-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp
memory/1008-2-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp
memory/1008-3-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp
memory/1008-4-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp
Analysis: behavioral21
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:11
Platform
win7-20240221-en
Max time kernel
1558s
Max time network
1792s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2012 wrote to memory of 2112 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2012 wrote to memory of 2112 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2012 wrote to memory of 2112 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2112-0-0x00000000001F0000-0x0000000000210000-memory.dmp
memory/2112-2-0x00000000025A0000-0x00000000025C0000-memory.dmp
memory/2112-1-0x0000000002480000-0x00000000024A0000-memory.dmp
memory/2112-4-0x00000000025A0000-0x00000000025C0000-memory.dmp
memory/2112-3-0x0000000002480000-0x00000000024A0000-memory.dmp
Analysis: behavioral25
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:17
Platform
win7-20240508-en
Max time kernel
1561s
Max time network
1793s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2428 wrote to memory of 2420 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2428 wrote to memory of 2420 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2428 wrote to memory of 2420 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2420-0-0x00000000000F0000-0x0000000000110000-memory.dmp
memory/2420-2-0x0000000002140000-0x0000000002160000-memory.dmp
memory/2420-1-0x0000000002120000-0x0000000002140000-memory.dmp
memory/2420-4-0x0000000002140000-0x0000000002160000-memory.dmp
memory/2420-3-0x0000000002120000-0x0000000002140000-memory.dmp
Analysis: behavioral13
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:57
Platform
win7-20240508-en
Max time kernel
1558s
Max time network
1797s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1772 wrote to memory of 2124 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1772 wrote to memory of 2124 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1772 wrote to memory of 2124 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2124-0-0x0000000000300000-0x0000000000320000-memory.dmp
memory/2124-2-0x0000000002170000-0x0000000002190000-memory.dmp
memory/2124-1-0x0000000000580000-0x00000000005A0000-memory.dmp
memory/2124-4-0x0000000002170000-0x0000000002190000-memory.dmp
memory/2124-3-0x0000000000580000-0x00000000005A0000-memory.dmp
Analysis: behavioral8
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:56
Platform
win10v2004-20240426-en
Max time kernel
1352s
Max time network
1792s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4164 wrote to memory of 3688 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 4164 wrote to memory of 3688 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
memory/3688-0-0x0000024C7BA10000-0x0000024C7BA30000-memory.dmp
memory/3688-1-0x0000024C7BA60000-0x0000024C7BA80000-memory.dmp
memory/3688-2-0x0000024C7BA80000-0x0000024C7BAA0000-memory.dmp
memory/3688-3-0x0000024C7BAA0000-0x0000024C7BAC0000-memory.dmp
memory/3688-4-0x0000024C7BA80000-0x0000024C7BAA0000-memory.dmp
memory/3688-5-0x0000024C7BAA0000-0x0000024C7BAC0000-memory.dmp
Analysis: behavioral12
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:56
Platform
win10v2004-20240508-en
Max time kernel
1352s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3180 wrote to memory of 3556 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 3180 wrote to memory of 3556 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 52.111.227.11:443 | tcp | |
| US | 8.8.8.8:53 | 73.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
memory/3556-0-0x000002147B5F0000-0x000002147B610000-memory.dmp
memory/3556-1-0x000002150D760000-0x000002150D780000-memory.dmp
memory/3556-2-0x000002150DBB0000-0x000002150DBD0000-memory.dmp
memory/3556-3-0x000002150DDE0000-0x000002150DE00000-memory.dmp
memory/3556-4-0x000002150DBB0000-0x000002150DBD0000-memory.dmp
memory/3556-5-0x000002150DDE0000-0x000002150DE00000-memory.dmp
Analysis: behavioral18
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:09
Platform
win10v2004-20240426-en
Max time kernel
1337s
Max time network
1795s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1504 wrote to memory of 1136 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1504 wrote to memory of 1136 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.73.42.20.in-addr.arpa | udp |
Files
memory/1136-0-0x0000021C5DAB0000-0x0000021C5DAD0000-memory.dmp
memory/1136-1-0x0000021C5DC00000-0x0000021C5DC20000-memory.dmp
memory/1136-3-0x0000021C5DC40000-0x0000021C5DC60000-memory.dmp
memory/1136-2-0x0000021C5DC20000-0x0000021C5DC40000-memory.dmp
memory/1136-5-0x0000021C5DC40000-0x0000021C5DC60000-memory.dmp
memory/1136-4-0x0000021C5DC20000-0x0000021C5DC40000-memory.dmp
Analysis: behavioral20
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:11
Platform
win10v2004-20240426-en
Max time kernel
1353s
Max time network
1804s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1584 wrote to memory of 3476 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1584 wrote to memory of 3476 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.239.69.13.in-addr.arpa | udp |
Files
memory/3476-0-0x00000121909C0000-0x00000121909E0000-memory.dmp
memory/3476-1-0x0000012190B00000-0x0000012190B20000-memory.dmp
memory/3476-2-0x0000012190B40000-0x0000012190B60000-memory.dmp
memory/3476-3-0x0000012190B60000-0x0000012190B80000-memory.dmp
memory/3476-5-0x0000012190B60000-0x0000012190B80000-memory.dmp
memory/3476-4-0x0000012190B40000-0x0000012190B60000-memory.dmp
Analysis: behavioral29
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:19
Platform
win7-20231129-en
Max time kernel
1563s
Max time network
1787s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2820 wrote to memory of 2184 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2820 wrote to memory of 2184 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2820 wrote to memory of 2184 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2184-0-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2184-2-0x0000000002590000-0x00000000025B0000-memory.dmp
memory/2184-1-0x0000000002570000-0x0000000002590000-memory.dmp
memory/2184-4-0x0000000002590000-0x00000000025B0000-memory.dmp
memory/2184-3-0x0000000002570000-0x0000000002590000-memory.dmp
Analysis: behavioral30
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:19
Platform
win10v2004-20240508-en
Max time kernel
1348s
Max time network
1794s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1208 wrote to memory of 1376 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 1208 wrote to memory of 1376 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.173.189.20.in-addr.arpa | udp |
Files
memory/1376-0-0x00000219A0340000-0x00000219A0360000-memory.dmp
memory/1376-1-0x00000219A04A0000-0x00000219A04C0000-memory.dmp
memory/1376-2-0x00000219A04C0000-0x00000219A04E0000-memory.dmp
memory/1376-3-0x0000021A32B50000-0x0000021A32B70000-memory.dmp
memory/1376-4-0x00000219A04C0000-0x00000219A04E0000-memory.dmp
memory/1376-5-0x0000021A32B50000-0x0000021A32B70000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 00:40
Platform
win10v2004-20240426-en
Max time kernel
1353s
Max time network
1790s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 64 wrote to memory of 2132 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 64 wrote to memory of 2132 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 184.139.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.65.42.20.in-addr.arpa | udp |
Files
memory/2132-0-0x0000015093640000-0x0000015093660000-memory.dmp
memory/2132-1-0x00000150936E0000-0x0000015093700000-memory.dmp
memory/2132-3-0x0000015125E90000-0x0000015125EB0000-memory.dmp
memory/2132-2-0x0000015093700000-0x0000015093720000-memory.dmp
memory/2132-4-0x0000015093700000-0x0000015093720000-memory.dmp
memory/2132-5-0x0000015125E90000-0x0000015125EB0000-memory.dmp
Analysis: behavioral15
Detonation Overview
Submitted
2024-05-26 10:59
Reported
2024-05-27 04:05
Platform
win7-20231129-en
Max time kernel
1563s
Max time network
1792s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2244 wrote to memory of 2248 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2244 wrote to memory of 2248 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
| PID 2244 wrote to memory of 2248 | N/A | C:\Windows\system32\cmd.exe | C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"
C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | xmr.2miners.com | udp |
| DE | 162.19.139.184:2222 | xmr.2miners.com | tcp |
Files
memory/2248-0-0x00000000001F0000-0x0000000000210000-memory.dmp
memory/2248-2-0x0000000002510000-0x0000000002530000-memory.dmp
memory/2248-1-0x00000000024F0000-0x0000000002510000-memory.dmp
memory/2248-4-0x0000000002510000-0x0000000002530000-memory.dmp
memory/2248-3-0x00000000024F0000-0x0000000002510000-memory.dmp