ca610938fbce79e1b39d0be34db05b71515c803ee347251f202df9c09dbc3ff4 | Triage

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:32

Sharing

Report Analysis Logs

General

Target

cz-x1/rtm_ghostrider_example.cmd
Size

1KB
MD5

3f0155abe745be1f6089eafc4f517ac8
SHA1

277f510ceb62b277b141d094c82eedebdc6f3a35
SHA256

810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
SHA512

8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2156	xmrig.exe
Token: SeLockMemoryPrivilege	2156	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2156	2572	cmd.exe	31
PID 2572 wrote to memory of 2156	2572	cmd.exe	31
PID 2572 wrote to memory of 2156	2572	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download