xmrig | b43a6927416ab67967e9dc316574cfa1d790e789c2d6bcf333617d80ce20e115

General

Target
2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
Size 6.0MB
Sample260510-s2vdmsbs41
SHA256 b43a6927416ab67967e9dc316574cfa1d790e789c2d6bcf333617d80ce20e115
MD5 be21652b6e9a0c631e41390fc6297bc0
SHA1 fe047875b61b992276da7d26970e7ae4e0d88bc5
SHA512 b922797ca5e22c4fa69d6fc14685efaaaa466bb1017395c477237e577bdcabb343a7c38eadbd2c59ed80b3a03d9633aa05e58abe2ce02ddfa61dc4caddb235f8
SSDEEP 98304:jvHIxhveuC3AjSwjpFaUjorjGFaWlvLtMQXfPS6xhel1kDlLpDfHfp+7+TYZyici:jv4dSBl1khLpDPs78gc
TLSH
T18D569D66B6A400E8C87BC17CCA475913E7B2B8165370A7DF16A45B7A1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/files/0x000800000002441a-1.dat	xmrig

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\WinRing0x64.sys	$77CM.exe

Executes dropped EXE 1 IoCs

pid	Process
4660	$77CM.exe

Power Settings 1 TTPs 9 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5260	powercfg.exe
816	powercfg.exe
3256	powercfg.exe
3040	powercfg.exe
552	cmd.exe
3876	powercfg.exe
5660	powercfg.exe
4468	powercfg.exe
2560	powercfg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
4356	2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3876	powercfg.exe
Token: SeCreatePagefilePrivilege	3876	powercfg.exe
Token: SeShutdownPrivilege	5660	powercfg.exe
Token: SeCreatePagefilePrivilege	5660	powercfg.exe
Token: SeShutdownPrivilege	5260	powercfg.exe
Token: SeCreatePagefilePrivilege	5260	powercfg.exe
Token: SeShutdownPrivilege	816	powercfg.exe
Token: SeCreatePagefilePrivilege	816	powercfg.exe
Token: SeShutdownPrivilege	816	powercfg.exe
Token: SeCreatePagefilePrivilege	816	powercfg.exe
Token: SeShutdownPrivilege	4468	powercfg.exe
Token: SeCreatePagefilePrivilege	4468	powercfg.exe
Token: SeShutdownPrivilege	3256	powercfg.exe
Token: SeCreatePagefilePrivilege	3256	powercfg.exe
Token: SeShutdownPrivilege	3040	powercfg.exe
Token: SeCreatePagefilePrivilege	3040	powercfg.exe
Token: SeShutdownPrivilege	2560	powercfg.exe
Token: SeCreatePagefilePrivilege	2560	powercfg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 552	4660	$77CM.exe	86
PID 552 wrote to memory of 1708	552	cmd.exe	88
PID 552 wrote to memory of 3876	552	cmd.exe	89
PID 552 wrote to memory of 5660	552	cmd.exe	90
PID 552 wrote to memory of 5260	552	cmd.exe	91
PID 552 wrote to memory of 816	552	cmd.exe	92
PID 552 wrote to memory of 4468	552	cmd.exe	93
PID 552 wrote to memory of 3256	552	cmd.exe	94
PID 552 wrote to memory of 3040	552	cmd.exe	95
PID 552 wrote to memory of 2560	552	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\ProgramData\$77CM.exe
C:\ProgramData\$77CM.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /change /tn "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /disable & powercfg /setactive SCHEME_MIN & powercfg /change standby-timeout-ac 0 & powercfg /change standby-timeout-dc 0 & powercfg /hibernate off & powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100 & powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100 & powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100 & powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /disable
    3⤵
    PID:1708
- - C:\Windows\system32\powercfg.exe
    powercfg /setactive SCHEME_MIN
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- - C:\Windows\system32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- - C:\Windows\system32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\system32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:816
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- - C:\Windows\system32\powercfg.exe
    powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- - C:\Windows\system32\powercfg.exe
    powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

1

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77CM.exe

Path C:\ProgramData\$77CM.exe
Size 5.8MB
SHA256 0a3df97c2bfcaf69568acd67c9a1e3f6d6d7e4ecd0cfca3f8721a94b3f671e70
MD5 be672d0fec97326ecd0553843ba990f3
SHA1 cc99506b3d636d2e2b9e025e3c2f9b192c09fd41
SHA512 ee5f24aff18dfb24135169fc09910b70b1a01e7f6acbb7ae8d38a760bfa7c4ebd68135c35390f63d5f92fc0baaf57ca05387c123fef9f7570f2aad5d0c68408a
SSDEEP 98304:cvHIxhveuC3AjSwjpFaUjorjGFaWlvLtMQXfPS6xhel1kDlLpDfHfp+7+TYZyici:cv4dSBl1khLpDPs78gc
TLSH
T1DD569D65B6A400E8C87BC17CCA475913E7B2B8165370A7DF16A45BBA1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-3-0x0000020294CC0000-0x0000020294CE0000-memory.dmp

Download

Analysis

Sharing