Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 18:07
General
-
Target
Start-Salvium.bat
-
Size
191B
-
MD5
83cdb39870b444d5cc499b9318567711
-
SHA1
c87327c471326341ac1ee095d824bf35e97e7b7a
-
SHA256
576761fbd2203cb3373f04dcd8b58c6730ffb4eb0bbe085a67e8fcdb48da0c1b
-
SHA512
57a646647cdf54c98311b418f7cab9495de714786b6f4f43732d9ffd8f9e7771850c73ce93cb061e32ae53dcb14ec0574fd30c7f08122d2f765c28a14bc88dbf
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Start-Salvium.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig.exexmrig.exe -a rx/0 --url "sal.kryptex.network:7777" --user SaLvsCNbjABPoCfjoVjytHf5Jqfd28NTD9kmkYUfSG7D2uzksP1TbNeDZB7ibriXB7D5M3YxfNZ7ER9amRZw25hQBR8kgDrhLRf/MyFirstRig -p x -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB