Resubmissions
30/10/2024, 16:49
241030-vbza1swpcx1029/10/2024, 09:34
241029-ljrfpstgmr1028/10/2024, 21:00
241028-ztq5ksvpgz1028/10/2024, 19:58
241028-yptjgatmel1028/10/2024, 15:14
241028-smk7esscne1028/10/2024, 12:51
241028-p3wfjsxmgw1028/10/2024, 12:42
241028-pxcq9azdkl1028/10/2024, 12:34
241028-prtgtazckn1028/10/2024, 12:21
241028-pjrm9azapr1028/10/2024, 10:36
241028-mm9l5avldj10Analysis
- max time kernel
148s - max time network
291s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
30/10/2024, 16:49
General
- Target PUB2/zephyr - Copie (9).bat
- Size 168B
- Sample241030-vbza1swpcx
- SHA256 4d4148fe8ab2368aaa811877b31d759d09b07df189587fed822d1011aca79a88
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PUB2\zephyr - Copie (9).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PUB2\xmrig.exexmrig.exe -o us-zephyr.miningocean.org:5342 -u ZEPHYR2c1KpUmMcFb1DgEejg8bgrit4x9L8TUEk2e7B7gbtwtHDVyKCUZEzu4zQMnGjgZjJZES6wnefC6FgLJeyL6Ahz2SsWsoK1Y -p scall -a rx/0 -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4564-0-0x0000018AA73E0000-0x0000018AA7400000-memory.dmp
memory/4564-1-0x0000018AA8EE0000-0x0000018AA8F00000-memory.dmp
memory/4564-3-0x0000018AA8F30000-0x0000018AA8F50000-memory.dmp
memory/4564-2-0x0000018AA8F00000-0x0000018AA8F20000-memory.dmp
memory/4564-4-0x0000018AA8F00000-0x0000018AA8F20000-memory.dmp
memory/4564-5-0x0000018AA8F30000-0x0000018AA8F50000-memory.dmp