258a76e26e34ada4e48c38fb2965115c47016dcb1116640903f8ab2dc94c98af

Analysis

max time kernel
1317s
max time network
1764s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 17:27

Target

miner8.0/rbxidle - Copy (23).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4816	xmrig.exe
Token: SeLockMemoryPrivilege	4816	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4816	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4816	8	cmd.exe	85
PID 8 wrote to memory of 4816	8	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner8.0\rbxidle - Copy (23).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\miner8.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4816

memory/4816-0-0x0000024864CB0000-0x0000024864CD0000-memory.dmp

Filesize
128KB

Download
memory/4816-1-0x00000248667C0000-0x00000248667E0000-memory.dmp

Filesize
128KB

Download
memory/4816-3-0x00000248F8E80000-0x00000248F8EA0000-memory.dmp

Filesize
128KB

Download
memory/4816-2-0x00000248F8C50000-0x00000248F8C70000-memory.dmp

Filesize
128KB

Download
memory/4816-4-0x00000248F8C50000-0x00000248F8C70000-memory.dmp

Filesize
128KB

Download
memory/4816-5-0x00000248F8E80000-0x00000248F8EA0000-memory.dmp

Filesize
128KB

Download