892f2ae73425bedf2b2e7534941959ff676496f02cdbbce9df8c0a83c4ee71c7

Analysis

max time kernel
719s
max time network
1048s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 12:00

Target

miner5.0/rbxidle - Copy (11).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2728	xmrig.exe
Token: SeLockMemoryPrivilege	2728	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2728	2556	cmd.exe	30
PID 2556 wrote to memory of 2728	2556	cmd.exe	30
PID 2556 wrote to memory of 2728	2556	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\miner5.0\rbxidle - Copy (11).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\miner5.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2728

memory/2728-0-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/2728-2-0x0000000002330000-0x0000000002350000-memory.dmp

Filesize
128KB

Download
memory/2728-1-0x0000000001D40000-0x0000000001D60000-memory.dmp

Filesize
128KB

Download
memory/2728-4-0x0000000002330000-0x0000000002350000-memory.dmp

Filesize
128KB

Download
memory/2728-3-0x0000000001D40000-0x0000000001D60000-memory.dmp

Filesize
128KB

Download