Analysis Overview
SHA256
a61c086b61e46d486da04b64b9e766d6ba6d1a8a13e199ae4573560910dbd5f1
Threat Level: Known bad
The file cz-e4da3b7fbbce2345d7772b0674a318d5.zip was found to be: Known bad.
Malicious Activity Summary
XMRig Miner payload
Xmrig family
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-11-13 11:20
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xmrig family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 11:20
Reported
2024-11-13 11:25
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
295s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sg-zephyr.miningocean.org | udp |
| SG | 51.79.157.201:5332 | sg-zephyr.miningocean.org | tcp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.157.79.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.143.182.52.in-addr.arpa | udp |
Files
memory/4704-0-0x00000296CD060000-0x00000296CD080000-memory.dmp
memory/4704-2-0x00000296CD100000-0x00000296CD120000-memory.dmp
memory/4704-3-0x00000296CD120000-0x00000296CD140000-memory.dmp
memory/4704-4-0x00000296CD140000-0x00000296CD160000-memory.dmp
memory/4704-5-0x00000296CD120000-0x00000296CD140000-memory.dmp
memory/4704-6-0x00000296CD140000-0x00000296CD160000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 11:20
Reported
2024-11-13 11:25
Platform
win10ltsc2021-20241023-en
Max time kernel
300s
Max time network
303s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sg-zephyr.miningocean.org | udp |
| SG | 51.79.157.201:5332 | sg-zephyr.miningocean.org | tcp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.157.79.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fd.api.iris.microsoft.com | udp |
Files
memory/1256-0-0x000002D41DF70000-0x000002D41DF90000-memory.dmp
memory/1256-2-0x000002D4B1A80000-0x000002D4B1AA0000-memory.dmp
memory/1256-3-0x000002D4B20F0000-0x000002D4B2110000-memory.dmp
memory/1256-4-0x000002D4B20D0000-0x000002D4B20F0000-memory.dmp
memory/1256-5-0x000002D4B20F0000-0x000002D4B2110000-memory.dmp
memory/1256-6-0x000002D4B20D0000-0x000002D4B20F0000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-11-13 11:20
Reported
2024-11-13 11:25
Platform
win11-20241023-en
Max time kernel
214s
Max time network
297s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\cz-e4da3b7fbbce2345d7772b0674a318d5\xmrig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | sg-zephyr.miningocean.org | udp |
| SG | 51.79.157.201:5332 | sg-zephyr.miningocean.org | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
memory/232-0-0x000002459F220000-0x000002459F240000-memory.dmp
memory/232-2-0x00000245A0B20000-0x00000245A0B40000-memory.dmp
memory/232-4-0x00000246332C0000-0x00000246332E0000-memory.dmp
memory/232-3-0x00000245A0B40000-0x00000245A0B60000-memory.dmp
memory/232-6-0x00000246332C0000-0x00000246332E0000-memory.dmp
memory/232-5-0x00000245A0B40000-0x00000245A0B60000-memory.dmp