Resubmissions

02-09-2024 17:55

240902-whk8eawapb 10

02-09-2024 10:22

240902-meef1sxhmn 10

Analysis

  • max time kernel
    1677s
  • max time network
    1758s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-09-2024 10:22

General

  • Target

    ETC XMR3/start (12).bat

  • Size

    110B

  • MD5

    5b696af5c780a7699a22b945dc062927

  • SHA1

    1f2a9887f83d7224ed710179da51080923fd1d7b

  • SHA256

    316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781

  • SHA512

    c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ETC XMR3\start (12).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\ETC XMR3\xmrig.exe
      xmrig.exe -o rx.unmineable.com:3333 -a rx -k -u BTC:bc1qvqn8wzhgdh8xfy2klz9f5r4q882fpl840e472e.cpu -p x
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3184-0-0x0000020177150000-0x0000020177170000-memory.dmp

    Filesize

    128KB

  • memory/3184-1-0x00000201772B0000-0x00000201772D0000-memory.dmp

    Filesize

    128KB

  • memory/3184-2-0x00000201772D0000-0x00000201772F0000-memory.dmp

    Filesize

    128KB

  • memory/3184-3-0x00000201772F0000-0x0000020177310000-memory.dmp

    Filesize

    128KB

  • memory/3184-4-0x00000201772D0000-0x00000201772F0000-memory.dmp

    Filesize

    128KB

  • memory/3184-5-0x00000201772F0000-0x0000020177310000-memory.dmp

    Filesize

    128KB