Malware Analysis Report

2025-08-06 02:11

Sample ID 241026-d3dpysygqe
Target PUB2.rar
SHA256 8bbab7c6d8c74646fec9b68eff9a0e1a7f294a9ea4e11c46e9161540cb6c5f7e
Tags
miner xmrig
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8bbab7c6d8c74646fec9b68eff9a0e1a7f294a9ea4e11c46e9161540cb6c5f7e

Threat Level: Known bad

The file PUB2.rar was found to be: Known bad.

Malicious Activity Summary

miner xmrig

XMRig Miner payload

Xmrig family

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-10-26 03:31

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xmrig family

xmrig

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

154s

Max time network

295s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (2).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 1620 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 4600 wrote to memory of 1620 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (2).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/1620-0-0x0000021ACCE40000-0x0000021ACCE60000-memory.dmp

memory/1620-1-0x0000021ACCF90000-0x0000021ACCFB0000-memory.dmp

memory/1620-2-0x0000021ACCFB0000-0x0000021ACCFD0000-memory.dmp

memory/1620-3-0x0000021ACCFD0000-0x0000021ACCFF0000-memory.dmp

memory/1620-4-0x0000021ACCFB0000-0x0000021ACCFD0000-memory.dmp

memory/1620-5-0x0000021ACCFD0000-0x0000021ACCFF0000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

269s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (3).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1824 wrote to memory of 3096 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 1824 wrote to memory of 3096 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (3).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp
N/A 20.199.58.43:443 tcp

Files

memory/3096-0-0x000001C628290000-0x000001C6282B0000-memory.dmp

memory/3096-1-0x000001C628400000-0x000001C628420000-memory.dmp

memory/3096-3-0x000001C628440000-0x000001C628460000-memory.dmp

memory/3096-2-0x000001C628420000-0x000001C628440000-memory.dmp

memory/3096-4-0x000001C628420000-0x000001C628440000-memory.dmp

memory/3096-5-0x000001C628440000-0x000001C628460000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

283s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (5).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1956 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 1956 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (5).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 227.162.46.104.in-addr.arpa udp
US 8.8.8.8:53 udp
N/A 20.223.35.26:443 tcp

Files

memory/4756-0-0x0000021836140000-0x0000021836160000-memory.dmp

memory/4756-1-0x0000021837A30000-0x0000021837A50000-memory.dmp

memory/4756-2-0x00000218CA1E0000-0x00000218CA200000-memory.dmp

memory/4756-3-0x00000218CA200000-0x00000218CA220000-memory.dmp

memory/4756-5-0x00000218CA200000-0x00000218CA220000-memory.dmp

memory/4756-4-0x00000218CA1E0000-0x00000218CA200000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

154s

Max time network

283s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

"C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
IE 20.223.35.26:443 fd.api.iris.microsoft.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 227.162.46.104.in-addr.arpa udp

Files

memory/1920-0-0x0000025731230000-0x0000025731250000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

102s

Max time network

261s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (10).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1064 wrote to memory of 1496 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 1064 wrote to memory of 1496 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (10).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/1496-0-0x000002039CF10000-0x000002039CF30000-memory.dmp

memory/1496-1-0x000002039CF60000-0x000002039CF80000-memory.dmp

memory/1496-2-0x000002039D090000-0x000002039D0B0000-memory.dmp

memory/1496-3-0x000002039D0B0000-0x000002039D0D0000-memory.dmp

memory/1496-4-0x000002039D090000-0x000002039D0B0000-memory.dmp

memory/1496-5-0x000002039D0B0000-0x000002039D0D0000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

154s

Max time network

279s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie.bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4696 wrote to memory of 4276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 4696 wrote to memory of 4276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie.bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/4276-0-0x000001FF3C300000-0x000001FF3C320000-memory.dmp

memory/4276-1-0x000001FF3DD40000-0x000001FF3DD60000-memory.dmp

memory/4276-3-0x000001FF3DD80000-0x000001FF3DDA0000-memory.dmp

memory/4276-2-0x000001FF3DD60000-0x000001FF3DD80000-memory.dmp

memory/4276-4-0x000001FF3DD60000-0x000001FF3DD80000-memory.dmp

memory/4276-5-0x000001FF3DD80000-0x000001FF3DDA0000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

272s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (11).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3100 wrote to memory of 2016 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 3100 wrote to memory of 2016 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (11).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/2016-0-0x0000022A09930000-0x0000022A09950000-memory.dmp

memory/2016-1-0x0000022A09980000-0x0000022A099A0000-memory.dmp

memory/2016-2-0x0000022A099A0000-0x0000022A099C0000-memory.dmp

memory/2016-3-0x0000022A099C0000-0x0000022A099E0000-memory.dmp

memory/2016-4-0x0000022A099A0000-0x0000022A099C0000-memory.dmp

memory/2016-5-0x0000022A099C0000-0x0000022A099E0000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

299s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (6).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 1452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 3272 wrote to memory of 1452 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (6).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/1452-0-0x00000146EADB0000-0x00000146EADD0000-memory.dmp

memory/1452-1-0x00000146EAF10000-0x00000146EAF30000-memory.dmp

memory/1452-2-0x00000146EAF30000-0x00000146EAF50000-memory.dmp

memory/1452-3-0x000001477D5C0000-0x000001477D5E0000-memory.dmp

memory/1452-4-0x00000146EAF30000-0x00000146EAF50000-memory.dmp

memory/1452-5-0x000001477D5C0000-0x000001477D5E0000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

282s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (8).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4688 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 4688 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (8).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/832-0-0x000001EEA7D40000-0x000001EEA7D60000-memory.dmp

memory/832-1-0x000001EEA7D90000-0x000001EEA7DB0000-memory.dmp

memory/832-3-0x000001EEA7DD0000-0x000001EEA7DF0000-memory.dmp

memory/832-2-0x000001EEA7DB0000-0x000001EEA7DD0000-memory.dmp

memory/832-5-0x000001EEA7DD0000-0x000001EEA7DF0000-memory.dmp

memory/832-4-0x000001EEA7DB0000-0x000001EEA7DD0000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

283s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (9).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 472 wrote to memory of 3704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 472 wrote to memory of 3704 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (9).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 227.162.46.104.in-addr.arpa udp

Files

memory/3704-0-0x0000021D58F50000-0x0000021D58F70000-memory.dmp

memory/3704-1-0x0000021D5A840000-0x0000021D5A860000-memory.dmp

memory/3704-2-0x0000021D5A880000-0x0000021D5A8A0000-memory.dmp

memory/3704-3-0x0000021D5A860000-0x0000021D5A880000-memory.dmp

memory/3704-5-0x0000021D5A860000-0x0000021D5A880000-memory.dmp

memory/3704-4-0x0000021D5A880000-0x0000021D5A8A0000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

303s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (12).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1688 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 1688 wrote to memory of 5088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (12).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
IE 20.223.35.26:443 fd.api.iris.microsoft.com tcp

Files

memory/5088-0-0x0000027E59200000-0x0000027E59220000-memory.dmp

memory/5088-1-0x0000027E59250000-0x0000027E59270000-memory.dmp

memory/5088-3-0x0000027E59290000-0x0000027E592B0000-memory.dmp

memory/5088-2-0x0000027E59270000-0x0000027E59290000-memory.dmp

memory/5088-5-0x0000027E59290000-0x0000027E592B0000-memory.dmp

memory/5088-4-0x0000027E59270000-0x0000027E59290000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

299s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (4).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1016 wrote to memory of 672 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 1016 wrote to memory of 672 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (4).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/672-0-0x0000025211620000-0x0000025211640000-memory.dmp

memory/672-1-0x0000025212F30000-0x0000025212F50000-memory.dmp

memory/672-3-0x0000025212F70000-0x0000025212F90000-memory.dmp

memory/672-2-0x0000025212F50000-0x0000025212F70000-memory.dmp

memory/672-4-0x0000025212F50000-0x0000025212F70000-memory.dmp

memory/672-5-0x0000025212F70000-0x0000025212F90000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

284s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (7).bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3772 wrote to memory of 3088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 3772 wrote to memory of 3088 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (7).bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.240.197:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.240.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp
US 8.8.8.8:53 udp
N/A 20.223.35.26:443 tcp

Files

memory/3088-0-0x0000022E84370000-0x0000022E84390000-memory.dmp

memory/3088-1-0x0000022E85E30000-0x0000022E85E50000-memory.dmp

memory/3088-3-0x0000022E85E70000-0x0000022E85E90000-memory.dmp

memory/3088-2-0x0000022E85E90000-0x0000022E85EB0000-memory.dmp

memory/3088-4-0x0000022E85E90000-0x0000022E85EB0000-memory.dmp

memory/3088-5-0x0000022E85E70000-0x0000022E85E90000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-26 03:31

Reported

2024-10-26 03:36

Platform

win10ltsc2021-20241023-en

Max time kernel

300s

Max time network

303s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr.bat"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2440 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
PID 2440 wrote to memory of 948 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr.bat"

C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe

xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 us-zephyr.miningocean.org udp
US 15.204.244.104:5342 us-zephyr.miningocean.org tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.244.204.15.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
IE 20.223.35.26:443 fd.api.iris.microsoft.com tcp

Files

memory/948-0-0x0000016DD83D0000-0x0000016DD83F0000-memory.dmp

memory/948-1-0x0000016DD8420000-0x0000016DD8440000-memory.dmp

memory/948-3-0x0000016DD8440000-0x0000016DD8460000-memory.dmp

memory/948-2-0x0000016DD8460000-0x0000016DD8480000-memory.dmp

memory/948-4-0x0000016DD8460000-0x0000016DD8480000-memory.dmp

memory/948-5-0x0000016DD8440000-0x0000016DD8460000-memory.dmp