9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
430s
max time network
1200s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-11-2024 22:06

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description pid process

Token: SeLockMemoryPrivilege 1900 xmrig.exe
Token: SeLockMemoryPrivilege 1900 xmrig.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid process

1900 xmrig.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2776 wrote to memory of 1900 2776 cmd.exe xmrig.exe
PID 2776 wrote to memory of 1900 2776 cmd.exe xmrig.exe

description	pid	process
Token: SeLockMemoryPrivilege	1900	xmrig.exe
Token: SeLockMemoryPrivilege	1900	xmrig.exe

pid	process
1900	xmrig.exe

description	pid	process	target process
PID 2776 wrote to memory of 1900	2776	cmd.exe	xmrig.exe
PID 2776 wrote to memory of 1900	2776	cmd.exe	xmrig.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1900

memory/1900-0-0x000002540D430000-0x000002540D450000-memory.dmp

Filesize
128KB

Download
memory/1900-1-0x000002540D570000-0x000002540D590000-memory.dmp

Filesize
128KB

Download
memory/1900-2-0x000002549FC20000-0x000002549FC40000-memory.dmp

Filesize
128KB

Download
memory/1900-3-0x000002549FC00000-0x000002549FC20000-memory.dmp

Filesize
128KB

Download
memory/1900-4-0x000002549FC20000-0x000002549FC40000-memory.dmp

Filesize
128KB

Download
memory/1900-5-0x000002549FC00000-0x000002549FC20000-memory.dmp

Filesize
128KB

Download