258a76e26e34ada4e48c38fb2965115c47016dcb1116640903f8ab2dc94c98af

Analysis

max time kernel
1794s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 17:27

Target

miner8.0/rbxidle - Copy (16).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4648	xmrig.exe
Token: SeLockMemoryPrivilege	4648	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4648	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4648	1360	cmd.exe	92
PID 1360 wrote to memory of 4648	1360	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner8.0\rbxidle - Copy (16).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\miner8.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4616,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3792,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:1248

memory/4648-0-0x000001A24E210000-0x000001A24E230000-memory.dmp

Filesize
128KB

Download
memory/4648-1-0x000001A24E350000-0x000001A24E370000-memory.dmp

Filesize
128KB

Download
memory/4648-3-0x000001A24E390000-0x000001A24E3B0000-memory.dmp

Filesize
128KB

Download
memory/4648-2-0x000001A24E370000-0x000001A24E390000-memory.dmp

Filesize
128KB

Download
memory/4648-4-0x000001A24E370000-0x000001A24E390000-memory.dmp

Filesize
128KB

Download
memory/4648-5-0x000001A24E390000-0x000001A24E3B0000-memory.dmp

Filesize
128KB

Download