9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
934s
max time network
1199s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-11-2024 22:04

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description pid process

Token: SeLockMemoryPrivilege 2492 xmrig.exe
Token: SeLockMemoryPrivilege 2492 xmrig.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid process

2492 xmrig.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1976 wrote to memory of 2492 1976 cmd.exe xmrig.exe
PID 1976 wrote to memory of 2492 1976 cmd.exe xmrig.exe

description	pid	process
Token: SeLockMemoryPrivilege	2492	xmrig.exe
Token: SeLockMemoryPrivilege	2492	xmrig.exe

pid	process
2492	xmrig.exe

description	pid	process	target process
PID 1976 wrote to memory of 2492	1976	cmd.exe	xmrig.exe
PID 1976 wrote to memory of 2492	1976	cmd.exe	xmrig.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2492

memory/2492-0-0x0000026090400000-0x0000026090420000-memory.dmp

Filesize
128KB

Download
memory/2492-1-0x0000026122590000-0x00000261225B0000-memory.dmp

Filesize
128KB

Download
memory/2492-3-0x0000026122C00000-0x0000026122C20000-memory.dmp

Filesize
128KB

Download
memory/2492-2-0x00000261229D0000-0x00000261229F0000-memory.dmp

Filesize
128KB

Download
memory/2492-4-0x00000261229D0000-0x00000261229F0000-memory.dmp

Filesize
128KB

Download
memory/2492-5-0x0000026122C00000-0x0000026122C20000-memory.dmp

Filesize
128KB

Download