9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
838s
max time network
1200s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 22:06

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description pid process

Token: SeLockMemoryPrivilege 3004 xmrig.exe
Token: SeLockMemoryPrivilege 3004 xmrig.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid process

3004 xmrig.exe

description	pid	process
Token: SeLockMemoryPrivilege	3004	xmrig.exe
Token: SeLockMemoryPrivilege	3004	xmrig.exe

pid	process
3004	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2756 wrote to memory of 3004	2756	cmd.exe	xmrig.exe
PID 2756 wrote to memory of 3004	2756	cmd.exe	xmrig.exe
PID 2756 wrote to memory of 3004	2756	cmd.exe	xmrig.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3004

memory/3004-0-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/3004-2-0x0000000002140000-0x0000000002160000-memory.dmp

Filesize
128KB

Download
memory/3004-1-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download
memory/3004-4-0x0000000002140000-0x0000000002160000-memory.dmp

Filesize
128KB

Download
memory/3004-3-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download