d3bd01c2160c969c3f66285cc285c08bf1a9a57b890bda57cf86c47667b4012c

Analysis

max time kernel
122s
max time network
247s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 05:43

Target
xmrig-6.21.3/pool_mine_example – kopija (3).cmd
Size 1023B
Sample240527-getytaaa4w
SHA256 e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad
MD5 2e737f5c3af9c8aa5216dfdc5be02cc6
SHA1 05fe2040aea6f6cff25deaf5ca2ca6793faa64c7
SHA512 ce0e12a544623458f5905ea20f2b6f0e75cfb57add912290fbf2611eddbe98de7ffed3c9e650747967b2620e5ebbe33e249cbd60e7032bdb10c909cc516709ca
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2896	xmrig.exe
Token: SeLockMemoryPrivilege	2896	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2896	1808	cmd.exe	29
PID 1808 wrote to memory of 2896	1808	cmd.exe	29
PID 1808 wrote to memory of 2896	1808	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\pool_mine_example – kopija (3).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe
  xmrig.exe -o xmrpool.eu:3333 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2896

memory/2896-0-0x0000000000080000-0x00000000000A0000-memory.dmp

Download