xmrig | 2430a0d0ccd007e36d679c0e1a4221e80eb0e458f716961aae6a886d2987dd5b

Analysis

max time kernel
46s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
Size 11.3MB
Sample260519-krkgpadt7l
SHA256 2430a0d0ccd007e36d679c0e1a4221e80eb0e458f716961aae6a886d2987dd5b
MD5 3d2a29eb9ce779de939e8eb6d03115e0
SHA1 06b3c9e17495eb3879702974102e7ca71feae6c0
SHA512 00438591091d22c4ba8babcec239ab9df50171a4764f6041d4a12588ba61e06eb912bf27e475845269790825c2604d4c7aafce73ae406c0781e211db4d4e2b97
SSDEEP 196608:G7Qi7uq4hzcbAphtldackFHmL50moOvv7Nr8K:TKBbApb4GVoOvvZr8K
TLSH
T133C69D51F9DB40F9E707447044A7632FB73136069338CAC7D7981A86EE63AE21A37726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (43914) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/files/0x001900000002b425-44.dat	xmrig

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
912	[kthreaddi].exe

Loads dropped DLL 4 IoCs

pid	Process
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2596	sc.exe
2812	sc.exe
4656	sc.exe
4012	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	912	[kthreaddi].exe
Token: SeLockMemoryPrivilege	912	[kthreaddi].exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4324	2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe	84
PID 4324 wrote to memory of 2596	4324	cmd.exe	85
PID 2504 wrote to memory of 4572	2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe	86
PID 4572 wrote to memory of 2812	4572	cmd.exe	87
PID 2504 wrote to memory of 3928	2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe	88
PID 3928 wrote to memory of 4656	3928	cmd.exe	89
PID 2504 wrote to memory of 2172	2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe	90
PID 2172 wrote to memory of 4012	2172	cmd.exe	91
PID 2504 wrote to memory of 3296	2504	2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe	92
PID 3296 wrote to memory of 912	3296	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_3d2a29eb9ce779de939e8eb6d03115e0_amadey_coinminer_darkgate_elex_glassworm_icedid_njrat_po.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "sc stop npf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "sc delete npf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc delete npf
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\sc.exe
    sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "sc start npf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\sc.exe
    sc start npf
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\.xrB6Af3g\[kthreaddi].exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Users\Admin\AppData\Local\Temp\.xrB6Af3g\[kthreaddi].exe
    C:\Users\Admin\AppData\Local\Temp\.xrB6Af3g\[kthreaddi].exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

[kthreaddi].exe

Path C:\Users\Admin\AppData\Local\Temp\.xrB6Af3g\[kthreaddi].exe
Size 2.0MB
SHA256 a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd
MD5 a7013a2c7fd3a6168a7c0d9eed825c32
SHA1 a3b6cf6090a425466606125aa881fdf56c1c2a67
SHA512 e2e6e447806adb5d27c77f8dc32772fc49ba5532e255e1a38e92a404efccbc8f3d820d4d674a51968e5c3c1079cb834253232bf13e6ff9d437c7d0e2551ba49d
SSDEEP 49152:jMoW3QuuTUF6MSQeVlIJyBnmjtOv8MpphRznUspZ6icSO4HiK:j502MSQeVlIonoOvv7NpF8K
TLSH
T176A58D1AB2A510F4D5ABC038C55B8A0BF7B13409437895DF62B502A91F73BD28E7EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\.xrB6Af3g\config.json
Size 2KB
SHA256 3822f56b003f61bb77788a2cdf7d4aef3a1bf9ed392b2344120ef7940813bb22
MD5 6a20ce0b7fe07df5d7f13cc0c0f3a0f8
SHA1 b9161fc18f3103f21dcd0ae8311705cd8ed300a2
SHA512 932d7b69fbd640684502caf95a25603776cc86fd26627fe48c6e118b70f9071e5a4b0460cb3d759b1ebebf4d44caadc7815aff7fa663ce9e90363816d5a0bafa
TLSH
T1B941E521C9380CBB1695613D98ECA283075981072F193C75B90CAD5C2F4D73F71B2BE6
MD5 SHA1 SHA512 TLSH

Submit Download

Packet.dll

Path C:\Users\Admin\AppData\Local\Temp\Packet.dll
Size 95KB
SHA256 30c2fcaa84912bfc8998edd1a6353422f3f82a0c56758a8c7f30c655ad1afbe2
MD5 3cbef749c11be9eb37611ca5475347cf
SHA1 d202c0d9459029b345d8747c43ce02b8334f11cd
SHA512 37203bd4916ee2156490634c0030e2be2eaa11f704cdca2cead2a7d30a91562ff66ea4e70a8a1743a12435df1886b393ffeaf1a90ecf0793de197d02aa60a9e7
SSDEEP 1536:Hg6Z54QkC2wpk2c+ZCDHKklh74ZLcGVrBoO0:A6Z54ARcIxkYwGVrBo1
TLSH
T1E3A38E523664C0F9E8965A7D006AC7337A3F76615FE984C33B530A8A5EE23D1377A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpcap.dll

Path C:\Users\Admin\AppData\Local\Temp\wpcap.dll
Size 275KB
SHA256 5871d331540c47b53a5851165d91c40d792e3b4aa35f0e0383afcbac66f8cf17
MD5 9acbc370154e80630255c7392f877c55
SHA1 8541b1f5ce42ec2881d57013b24e0fff242d0718
SHA512 529fbbd484187ff6e0416d6d130eff8a02f4564c4098c61bccd8324e41b9b96dae594938bfa658b435c414fdcfea738dc56d102580974ac58111fbf8d47ab1a9
SSDEEP 6144:34yIm5rC9WNWwKcNBSCiLvK8+j0gZBwIbgQ:oyIm59WwpqCuE0IwvQ
TLSH
T18F549D027F53C07AE55A0579116BBB178B3AA51127B1D4C3FFC06CABAC632D3667222D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-46-0x000002A176810000-0x000002A176824000-memory.dmp

Download

memory/912-48-0x000002A1781F0000-0x000002A178210000-memory.dmp

Download

memory/912-49-0x000002A20A6A0000-0x000002A20A6C0000-memory.dmp

Download

memory/912-50-0x000002A20A8D0000-0x000002A20A8F0000-memory.dmp

Download

memory/912-51-0x000002A20A6A0000-0x000002A20A6C0000-memory.dmp

Download

memory/912-52-0x000002A20A8D0000-0x000002A20A8F0000-memory.dmp

Download

memory/2504-33-0x00000000324F0000-0x0000000032508000-memory.dmp

Download

memory/2504-36-0x00000000324A0000-0x00000000324EC000-memory.dmp

Download

memory/2504-26-0x00000000324A0000-0x00000000324EC000-memory.dmp

Download