5b06e18380c2c8261419a482e5d54b189bbe9b0feaccd355c3cb1bc4aaedd017

Analysis

max time kernel
91s
max time network
261s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/10/2024, 02:52

Target
PUB/zephyr - Copie (2).bat
Size 168B
Sample241026-dcxedaydmf
SHA256 1b505be08a733dc065718fd0a7d74fbfc548cb5da12ef2cc13fe9c37b0e1d403
MD5 bbb27ab17da7523fee1a5fbed2daabf1
SHA1 c78a46ad5fce1346ea2c1904fe01b98221f2e704
SHA512 c72e36638550da66b9eac58de1fae8c293abe17e9265dea984ac3c505837b8c9d38a8c845aaa091b9d7df44230d4dc0a7b1085c3bcd12df86933d4278c169ec4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2452	xmrig.exe
Token: SeLockMemoryPrivilege	2452	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2452	2352	cmd.exe	80
PID 2352 wrote to memory of 2452	2352	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB\zephyr - Copie (2).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\PUB\xmrig.exe
  xmrig.exe -o us-zephyr.miningocean.org:5332 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2452

memory/2452-0-0x0000022AB51C0000-0x0000022AB51E0000-memory.dmp

Download

memory/2452-1-0x0000022AB5300000-0x0000022AB5320000-memory.dmp

Download

memory/2452-3-0x0000022AB5350000-0x0000022AB5370000-memory.dmp

Download

memory/2452-2-0x0000022AB5330000-0x0000022AB5350000-memory.dmp

Download

memory/2452-4-0x0000022AB5330000-0x0000022AB5350000-memory.dmp

Download

memory/2452-5-0x0000022AB5350000-0x0000022AB5370000-memory.dmp

Download