9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
437s
max time network
1198s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-11-2024 22:05

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description	pid	Process
Token: SeLockMemoryPrivilege	1628	xmrig.exe
Token: SeLockMemoryPrivilege	1628	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid	Process
1628	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 384 wrote to memory of 1628	384	cmd.exe	81
PID 384 wrote to memory of 1628	384	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1628

memory/1628-0-0x0000027AF26C0000-0x0000027AF26E0000-memory.dmp

Filesize
128KB

Download
memory/1628-1-0x0000027AF3FB0000-0x0000027AF3FD0000-memory.dmp

Filesize
128KB

Download
memory/1628-2-0x0000027AF3FD0000-0x0000027AF3FF0000-memory.dmp

Filesize
128KB

Download
memory/1628-3-0x0000027AF3FF0000-0x0000027AF4010000-memory.dmp

Filesize
128KB

Download
memory/1628-5-0x0000027AF3FF0000-0x0000027AF4010000-memory.dmp

Filesize
128KB

Download
memory/1628-4-0x0000027AF3FD0000-0x0000027AF3FF0000-memory.dmp

Filesize
128KB

Download