Malware Analysis Report

2025-04-19 17:55

Sample ID 240526-m3w1zagf98
Target OLD.rar
SHA256 3dda13d5f9e6b209fb76c69c25e9013797cc207e38ce3764c829947fc146c779
Tags
miner xmrig
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3dda13d5f9e6b209fb76c69c25e9013797cc207e38ce3764c829947fc146c779

Threat Level: Known bad

The file OLD.rar was found to be: Known bad.

Malicious Activity Summary

miner xmrig

XMRig Miner payload

Xmrig family

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-26 10:59

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xmrig family

xmrig

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:07

Platform

win10v2004-20240508-en

Max time kernel

1710s

Max time network

1797s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2716 wrote to memory of 3640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2716 wrote to memory of 3640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 204.79.197.237:443 g.bing.com tcp

Files

memory/3640-0-0x00000258EEE90000-0x00000258EEEB0000-memory.dmp

memory/3640-1-0x00000258EEEE0000-0x00000258EEF00000-memory.dmp

memory/3640-3-0x00000258EEF20000-0x00000258EEF40000-memory.dmp

memory/3640-2-0x00000258EEF00000-0x00000258EEF20000-memory.dmp

memory/3640-5-0x00000258EEF20000-0x00000258EEF40000-memory.dmp

memory/3640-4-0x00000258EEF00000-0x00000258EEF20000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:45

Platform

win7-20240419-en

Max time kernel

1563s

Max time network

1795s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2016 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 3000 wrote to memory of 2016 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 3000 wrote to memory of 2016 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2016-0-0x00000000002F0000-0x0000000000310000-memory.dmp

memory/2016-2-0x0000000002140000-0x0000000002160000-memory.dmp

memory/2016-1-0x0000000002120000-0x0000000002140000-memory.dmp

memory/2016-4-0x0000000002140000-0x0000000002160000-memory.dmp

memory/2016-3-0x0000000002120000-0x0000000002140000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:50

Platform

win10v2004-20240508-en

Max time kernel

1347s

Max time network

1795s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1128 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.239.69.13.in-addr.arpa udp

Files

memory/2204-0-0x000001BE7E8C0000-0x000001BE7E8E0000-memory.dmp

memory/2204-1-0x000001BE7E910000-0x000001BE7E930000-memory.dmp

memory/2204-2-0x000001BE7E930000-0x000001BE7E950000-memory.dmp

memory/2204-3-0x000001BE7E950000-0x000001BE7E970000-memory.dmp

memory/2204-4-0x000001BE7E930000-0x000001BE7E950000-memory.dmp

memory/2204-5-0x000001BE7E950000-0x000001BE7E970000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:56

Platform

win7-20231129-en

Max time kernel

1563s

Max time network

1786s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1600 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1600 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1600 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2196-0-0x0000000001BA0000-0x0000000001BC0000-memory.dmp

memory/2196-2-0x00000000024A0000-0x00000000024C0000-memory.dmp

memory/2196-1-0x0000000002040000-0x0000000002060000-memory.dmp

memory/2196-4-0x00000000024A0000-0x00000000024C0000-memory.dmp

memory/2196-3-0x0000000002040000-0x0000000002060000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:12

Platform

win10v2004-20240508-en

Max time kernel

1393s

Max time network

1786s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 1204 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2680 wrote to memory of 1204 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

memory/1204-0-0x0000024CF2C40000-0x0000024CF2C60000-memory.dmp

memory/1204-1-0x0000024CF4540000-0x0000024CF4560000-memory.dmp

memory/1204-3-0x0000024CF4580000-0x0000024CF45A0000-memory.dmp

memory/1204-2-0x0000024CF4560000-0x0000024CF4580000-memory.dmp

memory/1204-4-0x0000024CF4560000-0x0000024CF4580000-memory.dmp

memory/1204-5-0x0000024CF4580000-0x0000024CF45A0000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:12

Platform

win7-20240221-en

Max time kernel

1562s

Max time network

1788s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2316 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2084 wrote to memory of 2316 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2084 wrote to memory of 2316 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2316-0-0x00000000000F0000-0x0000000000110000-memory.dmp

memory/2316-2-0x0000000000310000-0x0000000000330000-memory.dmp

memory/2316-1-0x00000000002F0000-0x0000000000310000-memory.dmp

memory/2316-4-0x0000000000310000-0x0000000000330000-memory.dmp

memory/2316-3-0x00000000002F0000-0x0000000000310000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:17

Platform

win10v2004-20240508-en

Max time kernel

1351s

Max time network

1797s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 752 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 4524 wrote to memory of 752 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/752-0-0x0000022B82A50000-0x0000022B82A70000-memory.dmp

memory/752-1-0x0000022B82AA0000-0x0000022B82AC0000-memory.dmp

memory/752-2-0x0000022B82AC0000-0x0000022B82AE0000-memory.dmp

memory/752-3-0x0000022B82AE0000-0x0000022B82B00000-memory.dmp

memory/752-5-0x0000022B82AE0000-0x0000022B82B00000-memory.dmp

memory/752-4-0x0000022B82AC0000-0x0000022B82AE0000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:24

Platform

win7-20240221-en

Max time kernel

1556s

Max time network

1792s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"

Signatures

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2212 wrote to memory of 2948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2212 wrote to memory of 2948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2948-0-0x0000000000200000-0x0000000000220000-memory.dmp

memory/2948-2-0x0000000000540000-0x0000000000560000-memory.dmp

memory/2948-1-0x00000000002B0000-0x00000000002D0000-memory.dmp

memory/2948-4-0x0000000000540000-0x0000000000560000-memory.dmp

memory/2948-3-0x00000000002B0000-0x00000000002D0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:36

Platform

win7-20240508-en

Max time kernel

1558s

Max time network

1796s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1704 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1704 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2056-0-0x00000000002F0000-0x0000000000310000-memory.dmp

memory/2056-2-0x00000000005F0000-0x0000000000610000-memory.dmp

memory/2056-1-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/2056-4-0x00000000005F0000-0x0000000000610000-memory.dmp

memory/2056-3-0x00000000005D0000-0x00000000005F0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:40

Platform

win7-20240221-en

Max time kernel

1558s

Max time network

1799s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2864 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2864 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2864 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/1280-0-0x00000000000F0000-0x0000000000110000-memory.dmp

memory/1280-2-0x0000000000580000-0x00000000005A0000-memory.dmp

memory/1280-1-0x0000000000560000-0x0000000000580000-memory.dmp

memory/1280-4-0x0000000000580000-0x00000000005A0000-memory.dmp

memory/1280-3-0x0000000000560000-0x0000000000580000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:56

Platform

win7-20240215-en

Max time kernel

1558s

Max time network

1800s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2940 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1932 wrote to memory of 2940 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1932 wrote to memory of 2940 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2940-0-0x00000000000F0000-0x0000000000110000-memory.dmp

memory/2940-2-0x00000000005F0000-0x0000000000610000-memory.dmp

memory/2940-1-0x0000000000390000-0x00000000003B0000-memory.dmp

memory/2940-4-0x00000000005F0000-0x0000000000610000-memory.dmp

memory/2940-3-0x0000000000390000-0x00000000003B0000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:25

Platform

win10v2004-20240508-en

Max time kernel

1794s

Max time network

1800s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3764 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 3764 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (2).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4144,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/1200-0-0x000001CA85410000-0x000001CA85430000-memory.dmp

memory/1200-1-0x000001CA86D50000-0x000001CA86D70000-memory.dmp

memory/1200-2-0x000001CA86D70000-0x000001CA86D90000-memory.dmp

memory/1200-3-0x000001CB19500000-0x000001CB19520000-memory.dmp

memory/1200-4-0x000001CA86D70000-0x000001CA86D90000-memory.dmp

memory/1200-5-0x000001CB19500000-0x000001CB19520000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:18

Platform

win7-20231129-en

Max time kernel

1561s

Max time network

1789s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1372 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1372 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1372 wrote to memory of 2988 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2988-0-0x00000000002F0000-0x0000000000310000-memory.dmp

memory/2988-2-0x00000000025A0000-0x00000000025C0000-memory.dmp

memory/2988-1-0x0000000002580000-0x00000000025A0000-memory.dmp

memory/2988-4-0x00000000025A0000-0x00000000025C0000-memory.dmp

memory/2988-3-0x0000000002580000-0x00000000025A0000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:56

Platform

win10v2004-20240226-en

Max time kernel

1793s

Max time network

1803s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"

Signatures

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3364 wrote to memory of 4208 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 3364 wrote to memory of 4208 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4208 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
FR 172.217.20.202:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 202.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/4208-0-0x0000027D03FE0000-0x0000027D04000000-memory.dmp

memory/4208-1-0x0000027D04140000-0x0000027D04160000-memory.dmp

memory/4208-3-0x0000027D04180000-0x0000027D041A0000-memory.dmp

memory/4208-2-0x0000027D04160000-0x0000027D04180000-memory.dmp

memory/4208-5-0x0000027D04180000-0x0000027D041A0000-memory.dmp

memory/4208-4-0x0000027D04160000-0x0000027D04180000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:07

Platform

win7-20240221-en

Max time kernel

1558s

Max time network

1795s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2180 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2180 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2180 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2996-0-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2996-2-0x0000000002190000-0x00000000021B0000-memory.dmp

memory/2996-1-0x0000000000520000-0x0000000000540000-memory.dmp

memory/2996-4-0x0000000002190000-0x00000000021B0000-memory.dmp

memory/2996-3-0x0000000000520000-0x0000000000540000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:52

Platform

win7-20240419-en

Max time kernel

1566s

Max time network

1788s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1148 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1148 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1148 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2268-0-0x00000000002F0000-0x0000000000310000-memory.dmp

memory/2268-2-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/2268-1-0x00000000005B0000-0x00000000005D0000-memory.dmp

memory/2268-4-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/2268-3-0x00000000005B0000-0x00000000005D0000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:09

Platform

win7-20240508-en

Max time kernel

1565s

Max time network

1795s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1608 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1608 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1608 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/3036-0-0x0000000000300000-0x0000000000320000-memory.dmp

memory/3036-2-0x0000000002720000-0x0000000002740000-memory.dmp

memory/3036-1-0x0000000002600000-0x0000000002620000-memory.dmp

memory/3036-4-0x0000000002720000-0x0000000002740000-memory.dmp

memory/3036-3-0x0000000002600000-0x0000000002620000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:15

Platform

win10v2004-20240426-en

Max time kernel

1353s

Max time network

1788s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1804 wrote to memory of 3436 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1804 wrote to memory of 3436 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (13).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 252.15.104.51.in-addr.arpa udp

Files

memory/3436-0-0x0000013A9FD20000-0x0000013A9FD40000-memory.dmp

memory/3436-1-0x0000013AA1720000-0x0000013AA1740000-memory.dmp

memory/3436-2-0x0000013AA1740000-0x0000013AA1760000-memory.dmp

memory/3436-3-0x0000013AA1760000-0x0000013AA1780000-memory.dmp

memory/3436-5-0x0000013AA1760000-0x0000013AA1780000-memory.dmp

memory/3436-4-0x0000013AA1740000-0x0000013AA1760000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:43

Platform

win10v2004-20240508-en

Max time kernel

1706s

Max time network

1795s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1332 wrote to memory of 4020 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1332 wrote to memory of 4020 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 192.98.74.40.in-addr.arpa udp

Files

memory/4020-0-0x0000020990760000-0x0000020990780000-memory.dmp

memory/4020-1-0x00000209920A0000-0x00000209920C0000-memory.dmp

memory/4020-3-0x00000209920E0000-0x0000020992100000-memory.dmp

memory/4020-2-0x00000209920C0000-0x00000209920E0000-memory.dmp

memory/4020-4-0x00000209920C0000-0x00000209920E0000-memory.dmp

memory/4020-5-0x00000209920E0000-0x0000020992100000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:03

Platform

win10v2004-20240508-en

Max time kernel

1794s

Max time network

1799s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1764 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1764 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp

Files

memory/1200-0-0x000001389AFF0000-0x000001389B010000-memory.dmp

memory/1200-1-0x000001389B140000-0x000001389B160000-memory.dmp

memory/1200-3-0x000001392D7F0000-0x000001392D810000-memory.dmp

memory/1200-2-0x000001389B160000-0x000001389B180000-memory.dmp

memory/1200-5-0x000001392D7F0000-0x000001392D810000-memory.dmp

memory/1200-4-0x000001389B160000-0x000001389B180000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:18

Platform

win10v2004-20240426-en

Max time kernel

1344s

Max time network

1798s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1060 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1060 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (15).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/1008-0-0x000002104E230000-0x000002104E250000-memory.dmp

memory/1008-1-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp

memory/1008-2-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp

memory/1008-3-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp

memory/1008-4-0x00007FFAC1130000-0x00007FFAC1325000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:11

Platform

win7-20240221-en

Max time kernel

1558s

Max time network

1792s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2012 wrote to memory of 2112 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2012 wrote to memory of 2112 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2012 wrote to memory of 2112 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (12).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2112-0-0x00000000001F0000-0x0000000000210000-memory.dmp

memory/2112-2-0x00000000025A0000-0x00000000025C0000-memory.dmp

memory/2112-1-0x0000000002480000-0x00000000024A0000-memory.dmp

memory/2112-4-0x00000000025A0000-0x00000000025C0000-memory.dmp

memory/2112-3-0x0000000002480000-0x00000000024A0000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:17

Platform

win7-20240508-en

Max time kernel

1561s

Max time network

1793s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2428 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2428 wrote to memory of 2420 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (14).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2420-0-0x00000000000F0000-0x0000000000110000-memory.dmp

memory/2420-2-0x0000000002140000-0x0000000002160000-memory.dmp

memory/2420-1-0x0000000002120000-0x0000000002140000-memory.dmp

memory/2420-4-0x0000000002140000-0x0000000002160000-memory.dmp

memory/2420-3-0x0000000002120000-0x0000000002140000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:57

Platform

win7-20240508-en

Max time kernel

1558s

Max time network

1797s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1772 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1772 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1772 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2124-0-0x0000000000300000-0x0000000000320000-memory.dmp

memory/2124-2-0x0000000002170000-0x0000000002190000-memory.dmp

memory/2124-1-0x0000000000580000-0x00000000005A0000-memory.dmp

memory/2124-4-0x0000000002170000-0x0000000002190000-memory.dmp

memory/2124-3-0x0000000000580000-0x00000000005A0000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:56

Platform

win10v2004-20240426-en

Max time kernel

1352s

Max time network

1792s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4164 wrote to memory of 3688 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 4164 wrote to memory of 3688 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (3).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/3688-0-0x0000024C7BA10000-0x0000024C7BA30000-memory.dmp

memory/3688-1-0x0000024C7BA60000-0x0000024C7BA80000-memory.dmp

memory/3688-2-0x0000024C7BA80000-0x0000024C7BAA0000-memory.dmp

memory/3688-3-0x0000024C7BAA0000-0x0000024C7BAC0000-memory.dmp

memory/3688-4-0x0000024C7BA80000-0x0000024C7BAA0000-memory.dmp

memory/3688-5-0x0000024C7BAA0000-0x0000024C7BAC0000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:56

Platform

win10v2004-20240508-en

Max time kernel

1352s

Max time network

1795s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3180 wrote to memory of 3556 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 3180 wrote to memory of 3556 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (4).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/3556-0-0x000002147B5F0000-0x000002147B610000-memory.dmp

memory/3556-1-0x000002150D760000-0x000002150D780000-memory.dmp

memory/3556-2-0x000002150DBB0000-0x000002150DBD0000-memory.dmp

memory/3556-3-0x000002150DDE0000-0x000002150DE00000-memory.dmp

memory/3556-4-0x000002150DBB0000-0x000002150DBD0000-memory.dmp

memory/3556-5-0x000002150DDE0000-0x000002150DE00000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:09

Platform

win10v2004-20240426-en

Max time kernel

1337s

Max time network

1795s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1504 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1504 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (10).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/1136-0-0x0000021C5DAB0000-0x0000021C5DAD0000-memory.dmp

memory/1136-1-0x0000021C5DC00000-0x0000021C5DC20000-memory.dmp

memory/1136-3-0x0000021C5DC40000-0x0000021C5DC60000-memory.dmp

memory/1136-2-0x0000021C5DC20000-0x0000021C5DC40000-memory.dmp

memory/1136-5-0x0000021C5DC40000-0x0000021C5DC60000-memory.dmp

memory/1136-4-0x0000021C5DC20000-0x0000021C5DC40000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:11

Platform

win10v2004-20240426-en

Max time kernel

1353s

Max time network

1804s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1584 wrote to memory of 3476 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1584 wrote to memory of 3476 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (11).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.239.69.13.in-addr.arpa udp

Files

memory/3476-0-0x00000121909C0000-0x00000121909E0000-memory.dmp

memory/3476-1-0x0000012190B00000-0x0000012190B20000-memory.dmp

memory/3476-2-0x0000012190B40000-0x0000012190B60000-memory.dmp

memory/3476-3-0x0000012190B60000-0x0000012190B80000-memory.dmp

memory/3476-5-0x0000012190B60000-0x0000012190B80000-memory.dmp

memory/3476-4-0x0000012190B40000-0x0000012190B60000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:19

Platform

win7-20231129-en

Max time kernel

1563s

Max time network

1787s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2820 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2820 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2184-0-0x00000000005B0000-0x00000000005D0000-memory.dmp

memory/2184-2-0x0000000002590000-0x00000000025B0000-memory.dmp

memory/2184-1-0x0000000002570000-0x0000000002590000-memory.dmp

memory/2184-4-0x0000000002590000-0x00000000025B0000-memory.dmp

memory/2184-3-0x0000000002570000-0x0000000002590000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:19

Platform

win10v2004-20240508-en

Max time kernel

1348s

Max time network

1794s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1208 wrote to memory of 1376 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 1208 wrote to memory of 1376 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy - Copy (16).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/1376-0-0x00000219A0340000-0x00000219A0360000-memory.dmp

memory/1376-1-0x00000219A04A0000-0x00000219A04C0000-memory.dmp

memory/1376-2-0x00000219A04C0000-0x00000219A04E0000-memory.dmp

memory/1376-3-0x0000021A32B50000-0x0000021A32B70000-memory.dmp

memory/1376-4-0x00000219A04C0000-0x00000219A04E0000-memory.dmp

memory/1376-5-0x0000021A32B50000-0x0000021A32B70000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 00:40

Platform

win10v2004-20240426-en

Max time kernel

1353s

Max time network

1790s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 64 wrote to memory of 2132 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 64 wrote to memory of 2132 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (2) - Copy.cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/2132-0-0x0000015093640000-0x0000015093660000-memory.dmp

memory/2132-1-0x00000150936E0000-0x0000015093700000-memory.dmp

memory/2132-3-0x0000015125E90000-0x0000015125EB0000-memory.dmp

memory/2132-2-0x0000015093700000-0x0000015093720000-memory.dmp

memory/2132-4-0x0000015093700000-0x0000015093720000-memory.dmp

memory/2132-5-0x0000015125E90000-0x0000015125EB0000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-26 10:59

Reported

2024-05-27 04:05

Platform

win7-20231129-en

Max time kernel

1563s

Max time network

1792s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2244 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe
PID 2244 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\OLD\pool_mine_example - Copy (5).cmd"

C:\Users\Admin\AppData\Local\Temp\OLD\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2248-0-0x00000000001F0000-0x0000000000210000-memory.dmp

memory/2248-2-0x0000000002510000-0x0000000002530000-memory.dmp

memory/2248-1-0x00000000024F0000-0x0000000002510000-memory.dmp

memory/2248-4-0x0000000002510000-0x0000000002530000-memory.dmp

memory/2248-3-0x00000000024F0000-0x0000000002510000-memory.dmp