9be7bc61303fa298646fff5f74f1b26a34e71d830a6e7abbe822614f1aba4818

Analysis

max time kernel
1071s
max time network
1198s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-11-2024 22:05

Target

xmrig-6.22.0/pool_mine_example.cmd
Size

1KB
MD5

20f1482a6b8c4b2550e91d804179ec7b
SHA1

b29eac3009c5fcf5a543a4c86ad86c2b6a9b5ba2
SHA256

360a14d3a09a126423686a63375c813f226243a5942cd3e30e31e76a0f975f54
SHA512

5cbcf3838827d70cf60f686c9e2ed57aa7fb43ce43d3a7be57c4c8f6f5ea0c2bffd52a3082317f520a5f00fbf98080a0d73d0913f70488d60091bb2753eaf55c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xmrig.exe

description	pid	Process
Token: SeLockMemoryPrivilege	4816	xmrig.exe
Token: SeLockMemoryPrivilege	4816	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

xmrig.exe

pid	Process
4816	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 4584 wrote to memory of 4816	4584	cmd.exe	81
PID 4584 wrote to memory of 4816	4584	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\pool_mine_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0\xmrig.exe
  xmrig.exe -o gulf.moneroocean.stream:10032 -u 8AwagLhMr8DeT4qvEnLNVG7QMxU6UgqwjMPCeSQZjRNWHSYYYb26JvnMrxzZNVf6iySFrb7S6327v8ckkK73D31T7grqngR -p x
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4816

memory/4816-0-0x0000021C8A540000-0x0000021C8A560000-memory.dmp

Filesize
128KB

Download
memory/4816-1-0x0000021C8BE70000-0x0000021C8BE90000-memory.dmp

Filesize
128KB

Download
memory/4816-2-0x0000021C8BE90000-0x0000021C8BEB0000-memory.dmp

Filesize
128KB

Download
memory/4816-3-0x0000021C8BEB0000-0x0000021C8BED0000-memory.dmp

Filesize
128KB

Download
memory/4816-5-0x0000021C8BEB0000-0x0000021C8BED0000-memory.dmp

Filesize
128KB

Download
memory/4816-4-0x0000021C8BE90000-0x0000021C8BEB0000-memory.dmp

Filesize
128KB

Download