4c7980f083d635115e9a8a3e6657dba4fc63e4f8d2dcf57818f804a7bd403972

Resubmissions

25/10/2024, 07:52

241025-jqlspaxbjh10

24/10/2024, 13:45

241024-q2l16ayblf10

22/10/2024, 14:07

241022-rfce9s1bml10

Analysis

max time kernel
1565s
max time network
1800s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/10/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xmrig-6.22.0/pool_mine_example - Copy (11).cmd
Size 1KB
Sample241022-rfce9s1bml
SHA256 c64276ec8884e7294f0597b232f2db01e9aae35ad2aa52b2d38216aecd133df3
MD5 29bc32f9878d47d4cb332b21288f684e
SHA1 a950effcaf84c7f8838dc0b191bc434919acc06b
SHA512 4550e6b36fc0e6fb943761151137e00ab12e9549647ba8ad0d7006c4bb6df195a0060ae214cb40eeacc4539301b4e52d2f3f2be4d98272d85155eb20418d017b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2056	xmrig.exe
Token: SeLockMemoryPrivilege	2056	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2056	1664	cmd.exe	31
PID 1664 wrote to memory of 2056	1664	cmd.exe	31
PID 1664 wrote to memory of 2056	1664	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example - Copy (11).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -a rx/0 -k -o stratum+tcp://xmr-us-east1.nanopool.org:10300 -u 47KJeHrhm2xQzgxg3kYx4m8SsxDAgSXSPJAroo1aCWQN2XLdDUtFaYrgKqCbkxCQ2C9KWgGqCy94UByPc3EMVkNC88Ef6By.USER-Uy5VjRLKV2RlYDd --cpu-max-threads-hint=100""" & Chr(34), 0, FALSE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Download

memory/2056-1-0x00000000005D0000-0x00000000005F0000-memory.dmp

Download

memory/2056-2-0x0000000002170000-0x0000000002190000-memory.dmp

Download

memory/2056-3-0x00000000005D0000-0x00000000005F0000-memory.dmp

Download

memory/2056-4-0x0000000002170000-0x0000000002190000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads