258a76e26e34ada4e48c38fb2965115c47016dcb1116640903f8ab2dc94c98af

Analysis

max time kernel
1561s
max time network
1797s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 17:27

Target

miner8.0/rbxidle - Copy (24).cmd
Size

1KB
MD5

b5f4a1dc0788a0ac8a07d756f670aa3a
SHA1

f3927b48692de9a700884f76c3a01567d5795ddc
SHA256

cc30f748dd6595b4f9aba8b74a613ac96dfbbd614cd0fd93fe3577135e8b5096
SHA512

021e1c2f2062dd5cc49bd68414e574983f31a3d859764fde35b988fa9d4842133c6f9ff4aeb40469f4f577562f2da10a75c6e39c913673e316caa2f956e450c4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2956	xmrig.exe
Token: SeLockMemoryPrivilege	2956	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2956	2752	cmd.exe	31
PID 2752 wrote to memory of 2956	2752	cmd.exe	31
PID 2752 wrote to memory of 2956	2752	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\miner8.0\rbxidle - Copy (24).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\miner8.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-DcOoDP3s18LSRK! -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2956

memory/2956-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/2956-2-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/2956-1-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/2956-4-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/2956-3-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download