Resubmissions

01-09-2024 20:22

240901-y5yhcs1eje 10

01-09-2024 19:42

240901-yeyenszejm 10

01-09-2024 19:03

240901-xqa8vayhpr 10

01-09-2024 18:45

240901-xeh5bazbkb 10

Analysis

  • max time kernel
    434s
  • max time network
    1163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2024 19:42

General

  • Target

    ETC XMR4/start.bat

  • Size

    110B

  • MD5

    5b696af5c780a7699a22b945dc062927

  • SHA1

    1f2a9887f83d7224ed710179da51080923fd1d7b

  • SHA256

    316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781

  • SHA512

    c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ETC XMR4\start.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\ETC XMR4\xmrig.exe
      xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u BTC:bc1qvqn8wzhgdh8xfy2klz9f5r4q882fpl840e472e.cpu -p x
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4992-0-0x000001E461540000-0x000001E461560000-memory.dmp

    Filesize

    128KB

  • memory/4992-1-0x000001E4616A0000-0x000001E4616C0000-memory.dmp

    Filesize

    128KB

  • memory/4992-2-0x000001E4616C0000-0x000001E4616E0000-memory.dmp

    Filesize

    128KB

  • memory/4992-3-0x000001E4616E0000-0x000001E461700000-memory.dmp

    Filesize

    128KB

  • memory/4992-4-0x000001E4616C0000-0x000001E4616E0000-memory.dmp

    Filesize

    128KB

  • memory/4992-5-0x000001E4616E0000-0x000001E461700000-memory.dmp

    Filesize

    128KB