Analysis
- max time kernel
149s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20251218.1-en - resource tags
- submitted
23/12/2025, 11:55
General
- Target file.exe
- Size 4.9MB
- Sample251223-n3fveswpdz
- SHA256 21ef3d9d49fb149f8dde2ffe48f33d0772e6d7e3cc8f4cf7a26ad9c5a1847090
Malware Config
Signatures
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 9 IoCs
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Suspicious use of SetThreadContext 4 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "XRDRHAIS"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "XRDRHAIS" binpath= "C:\ProgramData\yinaabmojasb\contyqgzfgzn.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "XRDRHAIS"3⤵
- Launches sc.exe
-
-
-
C:\ProgramData\yinaabmojasb\contyqgzfgzn.exeC:\ProgramData\yinaabmojasb\contyqgzfgzn.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\yinaabmojasb\contyqgzfgzn.exe"C:\ProgramData\yinaabmojasb\contyqgzfgzn.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe3⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
contyqgzfgzn.exe
memory/4832-0-0x000001BB03EA0000-0x000001BB03EA1000-memory.dmp
memory/4832-3-0x000001BB03C10000-0x000001BB03E9D000-memory.dmp
memory/4832-1-0x000001BB03C10000-0x000001BB03E9D000-memory.dmp
memory/4832-4-0x000001BB03C10000-0x000001BB03E9D000-memory.dmp
memory/4832-6-0x000001BB03C10000-0x000001BB03E9D000-memory.dmp
memory/4964-34-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-29-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-30-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-33-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-24-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-35-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-32-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-23-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-26-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-31-0x0000023F94C60000-0x0000023F94C80000-memory.dmp
memory/4964-37-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-27-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-36-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-25-0x0000000140000000-0x0000000140848000-memory.dmp
memory/4964-38-0x0000000140000000-0x0000000140848000-memory.dmp
memory/5304-17-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5304-21-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5304-18-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5304-16-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5304-15-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5304-14-0x0000000140000000-0x000000014000D000-memory.dmp
memory/5752-22-0x00000228A4C00000-0x00000228A4E8D000-memory.dmp
memory/5752-10-0x00000228A4C00000-0x00000228A4E8D000-memory.dmp
memory/5752-9-0x00000228A4E90000-0x00000228A4E91000-memory.dmp
memory/5752-28-0x00000228A4C00000-0x00000228A4E8D000-memory.dmp
memory/5752-13-0x00000228A4C00000-0x00000228A4E8D000-memory.dmp