Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 23:26
General
- Target bootstrapper.exe
- Size 225KB
- Sample260426-3e8ymact8p
- SHA256 ec77bd059c08152d03398ace424e4c61198b427c4d6816e3d02db017df2bfdc3
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\PrismLauncher.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\PrismLauncher.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "ShellLogon" /tr "C:\Users\Toms\AppData\Local\Microsoft\Windows\Shell\shell.exe" /rl highest /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc onlogon /tn "ShellLogon" /tr "C:\Users\Toms\AppData\Local\Microsoft\Windows\Shell\shell.exe" /rl highest /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\xmrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\xmrig.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\syscore.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\syscore.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
7E7D146147E46C8361E336CACF0A16E6
8AD65D3207566995440E2C2CC379B7B0
D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
7E7D146147E46C8361E336CACF0A16E6
8AD65D3207566995440E2C2CC379B7B0
D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
xmrig[1].exe
PrismLauncher.exe
WinRing0x64.sys
config.json
syscore.exe
memory/1136-49-0x00000220E6EB0000-0x00000220E6F4E000-memory.dmp
memory/1136-187-0x00000220E7350000-0x00000220E735C000-memory.dmp
memory/1136-12-0x00000220E7350000-0x00000220E735C000-memory.dmp
memory/1136-11-0x00000220E6EB0000-0x00000220E6F4E000-memory.dmp
memory/1136-186-0x00000220E6EB0000-0x00000220E6F4E000-memory.dmp
memory/2548-52-0x00000264C51F0000-0x00000264C51FC000-memory.dmp
memory/2548-170-0x00000264C35B0000-0x00000264C364E000-memory.dmp
memory/2548-51-0x00000264C35B0000-0x00000264C364E000-memory.dmp
memory/3064-180-0x00000290CD9D0000-0x00000290CDA6E000-memory.dmp
memory/3064-138-0x00000290CF250000-0x00000290CF270000-memory.dmp
memory/3404-181-0x0000022DB8AD0000-0x0000022DB8B6E000-memory.dmp