xmrig | b43a6927416ab67967e9dc316574cfa1d790e789c2d6bcf333617d80ce20e115

General

Target
2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
Size 6.0MB
Sample260510-s2vdmsbs41
SHA256 b43a6927416ab67967e9dc316574cfa1d790e789c2d6bcf333617d80ce20e115
MD5 be21652b6e9a0c631e41390fc6297bc0
SHA1 fe047875b61b992276da7d26970e7ae4e0d88bc5
SHA512 b922797ca5e22c4fa69d6fc14685efaaaa466bb1017395c477237e577bdcabb343a7c38eadbd2c59ed80b3a03d9633aa05e58abe2ce02ddfa61dc4caddb235f8
SSDEEP 98304:jvHIxhveuC3AjSwjpFaUjorjGFaWlvLtMQXfPS6xhel1kDlLpDfHfp+7+TYZyici:jv4dSBl1khLpDPs78gc
TLSH
T18D569D66B6A400E8C87BC17CCA475913E7B2B8165370A7DF16A45B7A1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/files/0x002000000002b1c1-1.dat	xmrig

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\WinRing0x64.sys	$77CM.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	$77CM.exe

Power Settings 1 TTPs 9 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1628	powercfg.exe
3972	powercfg.exe
2920	powercfg.exe
3120	powercfg.exe
4756	powercfg.exe
3176	powercfg.exe
1196	cmd.exe
1248	powercfg.exe
4012	powercfg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
648	2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
648	2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1248	powercfg.exe
Token: SeCreatePagefilePrivilege	1248	powercfg.exe
Token: SeShutdownPrivilege	4012	powercfg.exe
Token: SeCreatePagefilePrivilege	4012	powercfg.exe
Token: SeShutdownPrivilege	3120	powercfg.exe
Token: SeCreatePagefilePrivilege	3120	powercfg.exe
Token: SeShutdownPrivilege	1628	powercfg.exe
Token: SeCreatePagefilePrivilege	1628	powercfg.exe
Token: SeShutdownPrivilege	1628	powercfg.exe
Token: SeCreatePagefilePrivilege	1628	powercfg.exe
Token: SeShutdownPrivilege	4756	powercfg.exe
Token: SeCreatePagefilePrivilege	4756	powercfg.exe
Token: SeShutdownPrivilege	3972	powercfg.exe
Token: SeCreatePagefilePrivilege	3972	powercfg.exe
Token: SeShutdownPrivilege	3176	powercfg.exe
Token: SeCreatePagefilePrivilege	3176	powercfg.exe
Token: SeShutdownPrivilege	2920	powercfg.exe
Token: SeCreatePagefilePrivilege	2920	powercfg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1196	5040	$77CM.exe	80
PID 1196 wrote to memory of 3056	1196	cmd.exe	82
PID 1196 wrote to memory of 1248	1196	cmd.exe	83
PID 1196 wrote to memory of 4012	1196	cmd.exe	84
PID 1196 wrote to memory of 3120	1196	cmd.exe	85
PID 1196 wrote to memory of 1628	1196	cmd.exe	86
PID 1196 wrote to memory of 4756	1196	cmd.exe	87
PID 1196 wrote to memory of 3972	1196	cmd.exe	88
PID 1196 wrote to memory of 3176	1196	cmd.exe	89
PID 1196 wrote to memory of 2920	1196	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_be21652b6e9a0c631e41390fc6297bc0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_xmrig.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:648

C:\ProgramData\$77CM.exe
C:\ProgramData\$77CM.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /change /tn "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /disable & powercfg /setactive SCHEME_MIN & powercfg /change standby-timeout-ac 0 & powercfg /change standby-timeout-dc 0 & powercfg /hibernate off & powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100 & powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100 & powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100 & powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic" /disable
    3⤵
    PID:3056
- - C:\Windows\system32\powercfg.exe
    powercfg /setactive SCHEME_MIN
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\system32\powercfg.exe
    powercfg /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\system32\powercfg.exe
    powercfg /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\system32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\system32\powercfg.exe
    powercfg /setacvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\system32\powercfg.exe
    powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- - C:\Windows\system32\powercfg.exe
    powercfg /setdcvalueindex SCHEME_MIN SUB_PROCESSOR PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

1

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77CM.exe

Path C:\ProgramData\$77CM.exe
Size 5.8MB
SHA256 0a3df97c2bfcaf69568acd67c9a1e3f6d6d7e4ecd0cfca3f8721a94b3f671e70
MD5 be672d0fec97326ecd0553843ba990f3
SHA1 cc99506b3d636d2e2b9e025e3c2f9b192c09fd41
SHA512 ee5f24aff18dfb24135169fc09910b70b1a01e7f6acbb7ae8d38a760bfa7c4ebd68135c35390f63d5f92fc0baaf57ca05387c123fef9f7570f2aad5d0c68408a
SSDEEP 98304:cvHIxhveuC3AjSwjpFaUjorjGFaWlvLtMQXfPS6xhel1kDlLpDfHfp+7+TYZyici:cv4dSBl1khLpDPs78gc
TLSH
T1DD569D65B6A400E8C87BC17CCA475913E7B2B8165370A7DF16A45BBA1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5040-3-0x000001A44DBB0000-0x000001A44DBD0000-memory.dmp

Download

Analysis

Sharing