2250742c48e534d30558354bce47741a3b853aa0047d48e42c84439c6af4b9ef

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 13:14

Target

ETC XMR2/start (9).bat
Size

110B
MD5

14110e8344eed821c253e1dab34d19d3
SHA1

5a050b43227e5bc75fc75806be937b6b7b026ad7
SHA256

864fc45ef4b24e418ab797aa9ea1f783d1610130265e4584f80ddde3a5546faa
SHA512

2a4396d9a71f1a6b2be9b28c7b509f25d7d6d9d35d48261affa51ffdbaa123b9ad233a14d8fba60032fa380bfae3449dded75886dfc39163e84fa92c878a03b6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1272	xmrig.exe
Token: SeLockMemoryPrivilege	1272	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1272	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1272	1540	cmd.exe	31
PID 1540 wrote to memory of 1272	1540	cmd.exe	31
PID 1540 wrote to memory of 1272	1540	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ETC XMR2\start (9).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\ETC XMR2\xmrig.exe
  xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x26f5F09149AfEE1dC78a5454E4bC8fB2c1e71fBD.cpu -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1272

memory/1272-0-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/1272-1-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/1272-2-0x0000000002290000-0x00000000022B0000-memory.dmp

Filesize
128KB

Download
memory/1272-3-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/1272-4-0x0000000002290000-0x00000000022B0000-memory.dmp

Filesize
128KB

Download