1a01dcef358dea50304457b6bc8188d8ab406c0ab239d94977481ce6dd199ea4 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cz-x17/pool_mine_example.cmd
Size

1023B
MD5

2e737f5c3af9c8aa5216dfdc5be02cc6
SHA1

05fe2040aea6f6cff25deaf5ca2ca6793faa64c7
SHA256

e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad
SHA512

ce0e12a544623458f5905ea20f2b6f0e75cfb57add912290fbf2611eddbe98de7ffed3c9e650747967b2620e5ebbe33e249cbd60e7032bdb10c909cc516709ca

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2816	xmrig.exe
Token: SeLockMemoryPrivilege	2816	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2816	2480	cmd.exe	31
PID 2480 wrote to memory of 2816	2480	cmd.exe	31
PID 2480 wrote to memory of 2816	2480	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cz-x17\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\cz-x17\xmrig.exe
  xmrig.exe -o xmrpool.eu:3333 -u 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-0-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download