Resubmissions

30/10/2024, 16:49

241030-vbza1swpcx 10

29/10/2024, 09:34

241029-ljrfpstgmr 10

28/10/2024, 21:00

241028-ztq5ksvpgz 10

28/10/2024, 19:58

241028-yptjgatmel 10

28/10/2024, 15:14

241028-smk7esscne 10

28/10/2024, 12:51

241028-p3wfjsxmgw 10

28/10/2024, 12:42

241028-pxcq9azdkl 10

28/10/2024, 12:34

241028-prtgtazckn 10

28/10/2024, 12:21

241028-pjrm9azapr 10

28/10/2024, 10:36

241028-mm9l5avldj 10

Analysis

  • max time kernel
    91s
  • max time network
    303s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/10/2024, 16:24

General

  • Target

    PUB2/zephyr - Copie (11).bat

  • Size

    168B

  • MD5

    ba22652cd85191f4cc7e21db61e2bd71

  • SHA1

    aece18a53876615b26eea19ad30409a447a5a8f6

  • SHA256

    4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88

  • SHA512

    df0cef76781eef6be0ada6fc8ca56de463d11c8b068ff0af2465dc97e05d910e5b9f10ecd95e9c0fd005ff8236cf52d2ea8f9de899dc7defceb3057c08a900a8

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (11).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exe
      xmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4040

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4040-0-0x000001C2A7E30000-0x000001C2A7E50000-memory.dmp

          Filesize

          128KB

        • memory/4040-1-0x000001C2A7F80000-0x000001C2A7FA0000-memory.dmp

          Filesize

          128KB

        • memory/4040-3-0x000001C2A7FA0000-0x000001C2A7FC0000-memory.dmp

          Filesize

          128KB

        • memory/4040-2-0x000001C2A7FC0000-0x000001C2A7FE0000-memory.dmp

          Filesize

          128KB

        • memory/4040-4-0x000001C2A7FC0000-0x000001C2A7FE0000-memory.dmp

          Filesize

          128KB

        • memory/4040-5-0x000001C2A7FA0000-0x000001C2A7FC0000-memory.dmp

          Filesize

          128KB