Overview
overview
10Static
static
10PUB/xmrig.exe
windows10-ltsc 2021-x64
1PUB/zephyr...2).bat
windows10-ltsc 2021-x64
1PUB/zephyr...3).bat
windows10-ltsc 2021-x64
1PUB/zephyr...4).bat
windows10-ltsc 2021-x64
1PUB/zephyr...5).bat
windows10-ltsc 2021-x64
1PUB/zephyr...6).bat
windows10-ltsc 2021-x64
1PUB/zephyr...7).bat
windows10-ltsc 2021-x64
1PUB/zephyr...8).bat
windows10-ltsc 2021-x64
1PUB/zephyr...9).bat
windows10-ltsc 2021-x64
1PUB/zephyr...ie.bat
windows10-ltsc 2021-x64
1PUB/zephyr.bat
windows10-ltsc 2021-x64
1Analysis
-
max time kernel
1613s -
max time network
1777s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
25/10/2024, 12:31
Behavioral task
behavioral1
Sample
PUB/xmrig.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
PUB/zephyr - Copie (2).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
PUB/zephyr - Copie (3).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
PUB/zephyr - Copie (4).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
PUB/zephyr - Copie (5).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
PUB/zephyr - Copie (6).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
PUB/zephyr - Copie (7).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
PUB/zephyr - Copie (8).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
PUB/zephyr - Copie (9).bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
PUB/zephyr - Copie.bat
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
PUB/zephyr.bat
Resource
win10ltsc2021-20241023-en
General
-
Target
PUB/zephyr - Copie (5).bat
-
Size
168B
-
MD5
bbb27ab17da7523fee1a5fbed2daabf1
-
SHA1
c78a46ad5fce1346ea2c1904fe01b98221f2e704
-
SHA256
1b505be08a733dc065718fd0a7d74fbfc548cb5da12ef2cc13fe9c37b0e1d403
-
SHA512
c72e36638550da66b9eac58de1fae8c293abe17e9265dea984ac3c505837b8c9d38a8c845aaa091b9d7df44230d4dc0a7b1085c3bcd12df86933d4278c169ec4
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1456 xmrig.exe Token: SeLockMemoryPrivilege 1456 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1456 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3560 wrote to memory of 1456 3560 cmd.exe 82 PID 3560 wrote to memory of 1456 3560 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB\zephyr - Copie (5).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\PUB\xmrig.exexmrig.exe -o us-zephyr.miningocean.org:5332 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1456
-