5b06e18380c2c8261419a482e5d54b189bbe9b0feaccd355c3cb1bc4aaedd017

Analysis

max time kernel
151s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/10/2024, 02:48

Target
PUB/zephyr - Copie (3).bat
Size 168B
Sample241026-dakykaydka
SHA256 1b505be08a733dc065718fd0a7d74fbfc548cb5da12ef2cc13fe9c37b0e1d403
MD5 bbb27ab17da7523fee1a5fbed2daabf1
SHA1 c78a46ad5fce1346ea2c1904fe01b98221f2e704
SHA512 c72e36638550da66b9eac58de1fae8c293abe17e9265dea984ac3c505837b8c9d38a8c845aaa091b9d7df44230d4dc0a7b1085c3bcd12df86933d4278c169ec4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4992	xmrig.exe
Token: SeLockMemoryPrivilege	4992	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4992	3592	cmd.exe	82
PID 3592 wrote to memory of 4992	3592	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB\zephyr - Copie (3).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\PUB\xmrig.exe
  xmrig.exe -o us-zephyr.miningocean.org:5332 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4992

memory/4992-0-0x0000020739690000-0x00000207396B0000-memory.dmp

Download

memory/4992-1-0x000002073AF80000-0x000002073AFA0000-memory.dmp

Download

memory/4992-2-0x00000207CD750000-0x00000207CD770000-memory.dmp

Download

memory/4992-3-0x000002073AFA0000-0x000002073AFC0000-memory.dmp

Download

memory/4992-4-0x00000207CD750000-0x00000207CD770000-memory.dmp

Download

memory/4992-5-0x000002073AFA0000-0x000002073AFC0000-memory.dmp

Download