Overview
overview
10Static
static
10ETC XMR3/s...1).bat
windows10-1703-x64
1ETC XMR3/s...1).bat
windows11-21h2-x64
1ETC XMR3/s...0).bat
windows10-1703-x64
1ETC XMR3/s...0).bat
windows11-21h2-x64
1ETC XMR3/s...1).bat
windows10-1703-x64
1ETC XMR3/s...1).bat
windows11-21h2-x64
1ETC XMR3/s...2).bat
windows10-1703-x64
1ETC XMR3/s...2).bat
windows11-21h2-x64
1ETC XMR3/s...3).bat
windows10-1703-x64
1ETC XMR3/s...3).bat
windows11-21h2-x64
1ETC XMR3/s...4).bat
windows10-1703-x64
1ETC XMR3/s...4).bat
windows11-21h2-x64
1ETC XMR3/s...5).bat
windows10-1703-x64
1ETC XMR3/s...5).bat
windows11-21h2-x64
1ETC XMR3/s...6).bat
windows10-1703-x64
1ETC XMR3/s...6).bat
windows11-21h2-x64
1ETC XMR3/s...2).bat
windows10-1703-x64
1ETC XMR3/s...2).bat
windows11-21h2-x64
1ETC XMR3/s...3).bat
windows10-1703-x64
1ETC XMR3/s...3).bat
windows11-21h2-x64
1ETC XMR3/s...4).bat
windows10-1703-x64
1ETC XMR3/s...4).bat
windows11-21h2-x64
1ETC XMR3/s...5).bat
windows10-1703-x64
1ETC XMR3/s...5).bat
windows11-21h2-x64
1ETC XMR3/s...6).bat
windows10-1703-x64
1ETC XMR3/s...6).bat
windows11-21h2-x64
1ETC XMR3/s...7).bat
windows10-1703-x64
1ETC XMR3/s...7).bat
windows11-21h2-x64
1ETC XMR3/s...8).bat
windows10-1703-x64
1ETC XMR3/s...8).bat
windows11-21h2-x64
1ETC XMR3/s...9).bat
windows10-1703-x64
1ETC XMR3/s...9).bat
windows11-21h2-x64
1Resubmissions
06-09-2024 21:46
240906-1mzzkszcrg 1006-09-2024 12:14
240906-pepyvsvhjr 1006-09-2024 07:36
240906-jfp3csvaqh 1006-09-2024 06:44
240906-hhtb5asbqb 1005-09-2024 22:18
240905-18btwasbpg 1005-09-2024 17:44
240905-wbcmpawdqr 1005-09-2024 12:36
240905-ps4dea1hlb 1005-09-2024 11:39
240905-nsmj8azdjl 10Analysis
-
max time kernel
1672s -
max time network
1790s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-09-2024 12:14
Behavioral task
behavioral1
Sample
ETC XMR3/start (1).bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
ETC XMR3/start (1).bat
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
ETC XMR3/start (10).bat
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
ETC XMR3/start (10).bat
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
ETC XMR3/start (11).bat
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
ETC XMR3/start (11).bat
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
ETC XMR3/start (12).bat
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
ETC XMR3/start (12).bat
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
ETC XMR3/start (13).bat
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
ETC XMR3/start (13).bat
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
ETC XMR3/start (14).bat
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
ETC XMR3/start (14).bat
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
ETC XMR3/start (15).bat
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
ETC XMR3/start (15).bat
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
ETC XMR3/start (16).bat
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
ETC XMR3/start (16).bat
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
ETC XMR3/start (2).bat
Resource
win10-20240611-en
Behavioral task
behavioral18
Sample
ETC XMR3/start (2).bat
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
ETC XMR3/start (3).bat
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
ETC XMR3/start (3).bat
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
ETC XMR3/start (4).bat
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
ETC XMR3/start (4).bat
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
ETC XMR3/start (5).bat
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
ETC XMR3/start (5).bat
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
ETC XMR3/start (6).bat
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
ETC XMR3/start (6).bat
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
ETC XMR3/start (7).bat
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
ETC XMR3/start (7).bat
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
ETC XMR3/start (8).bat
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
ETC XMR3/start (8).bat
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
ETC XMR3/start (9).bat
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
ETC XMR3/start (9).bat
Resource
win11-20240802-en
General
-
Target
ETC XMR3/start (11).bat
-
Size
110B
-
MD5
5b696af5c780a7699a22b945dc062927
-
SHA1
1f2a9887f83d7224ed710179da51080923fd1d7b
-
SHA256
316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
-
SHA512
c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 5064 xmrig.exe Token: SeLockMemoryPrivilege 5064 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5064 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4724 wrote to memory of 5064 4724 cmd.exe 81 PID 4724 wrote to memory of 5064 4724 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ETC XMR3\start (11).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\ETC XMR3\xmrig.exexmrig.exe -o rx.unmineable.com:3333 -a rx -k -u BTC:bc1qvqn8wzhgdh8xfy2klz9f5r4q882fpl840e472e.cpu -p x2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5064
-
Network
-
Remote address:8.8.8.8:53Requestrx.unmineable.comIN AResponserx.unmineable.comIN CNAMErx.unminable.comrx.unminable.comIN CNAMErx-eu.unminable.comrx-eu.unminable.comIN CNAMErx-eu-lon.unminable.comrx-eu-lon.unminable.comIN A161.35.34.195
-
Remote address:8.8.8.8:53Request195.34.35.161.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.229.48
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdaue03.australiaeast.cloudapp.azure.comonedscolprdaue03.australiaeast.cloudapp.azure.comIN A40.79.173.41
-
Remote address:8.8.8.8:53Request41.173.79.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEbg.microsoft.map.fastly.netbg.microsoft.map.fastly.netIN A199.232.210.172bg.microsoft.map.fastly.netIN A199.232.214.172
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN A
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN A
-
637 B 1.2kB 9 7
DNS Request
rx.unmineable.com
DNS Response
161.35.34.195
DNS Request
195.34.35.161.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.229.48
DNS Request
48.229.111.52.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Response
40.79.173.41
DNS Request
41.173.79.40.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Request
ctldl.windowsupdate.com
DNS Request
ctldl.windowsupdate.com
DNS Response
199.232.210.172199.232.214.172