xmrig | ba9337f82d9ba9138ad712c56a0407cc517f3227aae5f88df7f35bf5a5feaba7

Analysis

max time kernel
51s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 4.6MB
Sample260708-e8gjgaaz4x
SHA256 ba9337f82d9ba9138ad712c56a0407cc517f3227aae5f88df7f35bf5a5feaba7
MD5 5c24cb7fd8a6a2a313e09580de3658bf
SHA1 e8bd14f0d02df1315c8e81ee589d31576d27ef10
SHA512 0c3b702bd113d3f14734a5fd94138fd7b7f9ea13868895bc9809c21bf13e09f70e65bf9cdb5c943359ac1dbb30ce12515cd35340810e244afcf2d782509f4a2f
SSDEEP 49152:ax6Dq4W/3OVatyer9kxRZKtfmG0Hm/XQqzGP85E7sLSVpvcxVc:NWvOVatxhk0hmmE7okxcx+
TLSH
T1D9264917EC9545E9C0EEE631CA229252BE717C485B3027D72B60F7382F76BD0AA79344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/files/0x000700000002462f-96.dat	family_xmrig
behavioral1/files/0x000700000002462f-96.dat	xmrig
behavioral1/memory/2516-109-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/2516-110-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/2516-129-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/2516-173-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/2516-218-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/1976-248-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig
behavioral1/memory/2516-249-0x00007FF636310000-0x00007FF636D06000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
632	powershell.exe
1944	powershell.exe
4980	powershell.exe
2140	powershell.exe
4344	powershell.exe
4752	powershell.exe
4676	powershell.exe
2476	powershell.exe
2324	powershell.exe
4172	powershell.exe
3652	powershell.exe
2972	powershell.exe
4400	powershell.exe
1948	powershell.exe
2616	powershell.exe
2696	powershell.exe
4028	powershell.exe
2684	powershell.exe
3256	powershell.exe
2324	powershell.exe
2512	powershell.exe
1172	powershell.exe
1496	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2516	vltrig.exe
4216	RuntimeBroker.exe
836	RuntimeBroker.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	17	172.64.32.242	2516	vltrig.exe
Destination IP		172.64.32.242		Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsNetworkHelper = "C:\\ProgramData\\MiningApp\\netsvcs\\RuntimeBroker.exe --guard"	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	RuntimeBroker.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4748	sc.exe
2036	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe
696	schtasks.exe
2176	schtasks.exe
4568	schtasks.exe
3068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3256	powershell.exe
3256	powershell.exe
2140	powershell.exe
2140	powershell.exe
2972	powershell.exe
2972	powershell.exe
2324	powershell.exe
2324	powershell.exe
2512	powershell.exe
2512	powershell.exe
4400	powershell.exe
4400	powershell.exe
1172	powershell.exe
1172	powershell.exe
1496	powershell.exe
1496	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
2616	powershell.exe
2616	powershell.exe
2616	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
632	powershell.exe
632	powershell.exe
632	powershell.exe
4676	powershell.exe
4676	powershell.exe
4676	powershell.exe
2476	powershell.exe
2476	powershell.exe
2476	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeLockMemoryPrivilege	2516	vltrig.exe
Token: SeLockMemoryPrivilege	2516	vltrig.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	vltrig.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3256	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	84
PID 3604 wrote to memory of 2140	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	86
PID 3604 wrote to memory of 2972	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	88
PID 3604 wrote to memory of 2324	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	91
PID 3604 wrote to memory of 2512	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	93
PID 3604 wrote to memory of 4400	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	95
PID 3604 wrote to memory of 1172	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	99
PID 3604 wrote to memory of 1496	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	102
PID 3604 wrote to memory of 2516	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	105
PID 3604 wrote to memory of 2960	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	106
PID 3604 wrote to memory of 696	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	108
PID 3604 wrote to memory of 2176	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	110
PID 3604 wrote to memory of 4748	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	112
PID 3604 wrote to memory of 2036	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	114
PID 836 wrote to memory of 1948	836	RuntimeBroker.exe	123
PID 836 wrote to memory of 2616	836	RuntimeBroker.exe	128
PID 836 wrote to memory of 4344	836	RuntimeBroker.exe	130
PID 3604 wrote to memory of 4752	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	132
PID 836 wrote to memory of 632	836	RuntimeBroker.exe	134
PID 3604 wrote to memory of 4676	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	136
PID 836 wrote to memory of 2476	836	RuntimeBroker.exe	138
PID 3604 wrote to memory of 2324	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	140
PID 836 wrote to memory of 4172	836	RuntimeBroker.exe	142
PID 3604 wrote to memory of 1944	3604	2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\ProgramData\MiningApp\netsvcs\vltrig.exe
  C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
  2⤵
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2516
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2960
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:696
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2176
- C:\Windows\system32\sc.exe
  sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
  2⤵
  - Launches sc.exe
  - System Time Discovery
  PID:4748
- C:\Windows\system32\sc.exe
  sc start systemd-networkd-helper
  2⤵
  - Launches sc.exe
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2684

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4216

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3652
- C:\ProgramData\MiningApp\netsvcs\vltrig.exe
  C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
  2⤵
  PID:1976
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4568
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 241B
SHA256 611b7e22cccc65dd2ee05a202ae5161a865dbe0aee4b1f6a514edb479bc93f18
MD5 17a1d798c401173ffb32d9d2d87277bf
SHA1 6f219a63475bcb86f9c23dbfd605035e3fd604a1
SHA512 9f3acb6fce910c51fa3927b032bee98cdf6f1a030123a333c3210a8670a933dea782d200a1bacd15c786601bb93aa43a35ca150a86b4a304b86436cd0364e859
TLSH
T176D05E5C0AEE5624BF4310D2C9254B91C78AF721330EC930F75853499321137EFB1C92
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 299B
SHA256 8df2f9dd7b1dd774a2b559785539d3b4a2344288e19b681dd4b08a214e3d86d7
MD5 9f947161f3d770424200bd7d2a77c566
SHA1 b471e50dd399f03bdac8997238deacecc0310aa7
SHA512 0b7ebc6f9ade379a16f50f60c753efbd2453cb0813a3d0aabed5a12144f0f4964eaf852622b240bf9af644093a4ad971788fb8e6cbc3e236c5375c67018356a5
TLSH
T1FDE08C6C0AED0524BF831092C9214B91C78AF725330EC961B3986749932103BDFB5CC2
MD5 SHA1 SHA512 TLSH

Submit Download

.worker

Path C:\ProgramData\MiningApp\netsvcs\.worker
Size 18B
SHA256 b0c00a0e5baea510f9165d0d4aa8272911bf68150e49f110d921d3888e6a4676
MD5 109426f79e6c03f84b71ae803a1d7281
SHA1 7f4ec79044c98b9406b7fd77ae274de4ed2f6338
SHA512 55ba6f0b52e6e9bbff9f726caa81075660a79a8d1c3f5b3c748e9c8ae0d18f175d23af158486930e772a732fb0d992205d465e485fe8626148454ada1dabd699
MD5 SHA1 SHA512

Submit Download

RuntimeBroker.exe

Path C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
Size 4.6MB
SHA256 ba9337f82d9ba9138ad712c56a0407cc517f3227aae5f88df7f35bf5a5feaba7
MD5 5c24cb7fd8a6a2a313e09580de3658bf
SHA1 e8bd14f0d02df1315c8e81ee589d31576d27ef10
SHA512 0c3b702bd113d3f14734a5fd94138fd7b7f9ea13868895bc9809c21bf13e09f70e65bf9cdb5c943359ac1dbb30ce12515cd35340810e244afcf2d782509f4a2f
SSDEEP 49152:ax6Dq4W/3OVatyer9kxRZKtfmG0Hm/XQqzGP85E7sLSVpvcxVc:NWvOVatxhk0hmmE7okxcx+
TLSH
T1D9264917EC9545E9C0EEE631CA229252BE717C485B3027D72B60F7382F76BD0AA79344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\ProgramData\MiningApp\netsvcs\config.json
Size 545B
SHA256 d92a54b9cba44a39ce4d447a019a4cf2d3ad3653b6cb352071d4e67efa227186
MD5 2637bc45b75887a57281d3226fea168f
SHA1 65a252377081fdd157423c9bc819c440ca579651
SHA512 538ac3991d3e419923211d6faad8468af6e3452590e81dbcff892877dd8cb72f6128dde27ac775d8375ad5349e2066abd3f2696dc29fe05ceaaf5e15ead6a46d
TLSH
T10BF08B25DD754CB711E8303C54AFB1C313648E430A543D20761E821C3F4E62EA4F669C
MD5 SHA1 SHA512 TLSH

Submit Download

vltrig.exe

Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
Size 9.2MB
SHA256 db49da040d1351fad14abb792ac5f1ffd44c01f89cf7c0a731d50a0c8ccc0923
MD5 9c6b43d1e2dd6ff9ab8627fb30b86cdd
SHA1 5d4a86b97b1aaea1a9c8c335aa323ab9b1cee667
SHA512 ac5937ef0660053aac3c6e282d7c538ccf3665082408f92fb911f1aea8fcff14c1ff898822eafa7d99b62ccdcc40d4f1397d90fcebe4fddab35a5eabd2c377a4
SSDEEP 98304:M3Sgvt5PUzhdleCmCE8tpXbN07km7eXjNiM14g8ZD/tvQjIvUY+2NgmiT8k:OzPeBSezXIvdhg0
TLSH
T18AA66B6BE1A710ECC66BC1708257A772FA31B85801347E7F2690DBB12F61E505F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download