9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
429s
max time network
1200s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 22:05

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description	pid	Process
Token: SeLockMemoryPrivilege	4604	xmrig.exe
Token: SeLockMemoryPrivilege	4604	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid	Process
4604	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 4744 wrote to memory of 4604	4744	cmd.exe	83
PID 4744 wrote to memory of 4604	4744	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4604

memory/4604-0-0x000001E31C470000-0x000001E31C490000-memory.dmp

Filesize
128KB

Download
memory/4604-1-0x000001E31DEB0000-0x000001E31DED0000-memory.dmp

Filesize
128KB

Download
memory/4604-2-0x000001E31DED0000-0x000001E31DEF0000-memory.dmp

Filesize
128KB

Download
memory/4604-3-0x000001E3B0550000-0x000001E3B0570000-memory.dmp

Filesize
128KB

Download
memory/4604-4-0x000001E31DED0000-0x000001E31DEF0000-memory.dmp

Filesize
128KB

Download
memory/4604-5-0x000001E3B0550000-0x000001E3B0570000-memory.dmp

Filesize
128KB

Download