8bbab7c6d8c74646fec9b68eff9a0e1a7f294a9ea4e11c46e9161540cb6c5f7e

Resubmissions

28/10/2024, 12:20

241028-ph2f3awrbl10

28/10/2024, 10:29

27/10/2024, 22:14

27/10/2024, 17:07

27/10/2024, 16:55

27/10/2024, 16:25

27/10/2024, 15:08

27/10/2024, 15:07

Analysis

max time kernel
300s
max time network
304s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27/10/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PUB2/zephyr - Copie (10).bat
Size 168B
Sample241027-154eqavbjj
SHA256 4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88
MD5 ba22652cd85191f4cc7e21db61e2bd71
SHA1 aece18a53876615b26eea19ad30409a447a5a8f6
SHA512 df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3752	xmrig.exe
Token: SeLockMemoryPrivilege	3752	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3752	1564	cmd.exe	81
PID 1564 wrote to memory of 3752	1564	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (10).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
  xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3752-0-0x00000206C2870000-0x00000206C2890000-memory.dmp

Download

memory/3752-1-0x00000206C4340000-0x00000206C4360000-memory.dmp

Download

memory/3752-2-0x00000206C4360000-0x00000206C4380000-memory.dmp

Download

memory/3752-3-0x00000206C4380000-0x00000206C43A0000-memory.dmp

Download

memory/3752-4-0x00000206C4360000-0x00000206C4380000-memory.dmp

Download

memory/3752-5-0x00000206C4380000-0x00000206C43A0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads