xmrig | 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Size 10.4MB
Sample260708-wpb83sd18p
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xmrig miner persistence ransomware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000024340-4.dat	family_xmrig
behavioral1/files/0x0007000000024340-4.dat	xmrig
behavioral1/memory/2916-78-0x00007FF7F76F0000-0x00007FF7F8072000-memory.dmp	xmrig
behavioral1/memory/3976-80-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp	xmrig
behavioral1/memory/3948-91-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp	xmrig
behavioral1/files/0x0007000000024348-102.dat	family_xmrig
behavioral1/files/0x0007000000024348-102.dat	xmrig
behavioral1/memory/3948-106-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp	xmrig

Clears Windows event logs 1 TTPs 2 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4316	wevtutil.exe
3068	wevtutil.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	svchost.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 3 IoCs

pid	Process
3948	svchost.exe
3976	svchost.exe
4248	svchost32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
7	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe
3948	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4316	wevtutil.exe
Token: SeBackupPrivilege	4316	wevtutil.exe
Token: SeSecurityPrivilege	3068	wevtutil.exe
Token: SeBackupPrivilege	3068	wevtutil.exe
Token: SeLockMemoryPrivilege	4248	svchost32.exe
Token: SeLockMemoryPrivilege	4248	svchost32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4248	svchost32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4816	2916	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	87
PID 2916 wrote to memory of 4020	2916	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	89
PID 4816 wrote to memory of 4376	4816	cmd.exe	91
PID 4020 wrote to memory of 4316	4020	cmd.exe	92
PID 2916 wrote to memory of 3948	2916	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	93
PID 3948 wrote to memory of 1548	3948	svchost.exe	94
PID 3948 wrote to memory of 2748	3948	svchost.exe	96
PID 1548 wrote to memory of 3280	1548	cmd.exe	98
PID 2748 wrote to memory of 3068	2748	cmd.exe	99
PID 3948 wrote to memory of 4248	3948	svchost.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Windows-Security"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3280
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows-Security"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
    "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4248

C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
1⤵
- Executes dropped EXE
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Roaming\WindowsHost\config.json
Size 2KB
SHA256 9b97a6774eb28fd3d52829ea443085376c168c5b9681519a14fe273398767369
MD5 b97be153137f5d44161ede820bfb3e86
SHA1 01dd63af973f7e99266d58769a3110e971d38183
SHA512 42b07b9a6409829c7583ac6b0d1f82e8eaa12248271c77038c589f5b48f24fc15f2a30fd45e2ea544bdae257410b0d35801839abf6407c4767c0379cbf66f0c5
TLSH
T12D51D325C9600CFF19B9A15C96B4B393DA69831B23410C3F75FC995C2F37A36B142BA9
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
Size 10.4MB
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
Size 8.7MB
SHA256 070e24574b5252e5bab26d0a87e041e171104dcc786101a2322a0d0bd1988f23
MD5 ebd618f13938643dbb3a2814e7bb6e4a
SHA1 f596735903337e21e1a82bbfabdf3a93fa842931
SHA512 4efeecab8b620d55001a08f415cb394296cd82bfed7fa8cf09d74874116bdd95dbf0b6ae9a4d6f793dc0f39f8fec2ce98f5f2a7ff35cb6efc2b3b7dc0658f3ac
SSDEEP 196608:A/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+k:AkFCUatKWEe6J+FeK/Ra+NMxBk
TLSH
T14496CF16B7A400E8C87AC53CC64A9513E7B1B81953B0A7DB26F4967A1F33BD41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2916-78-0x00007FF7F76F0000-0x00007FF7F8072000-memory.dmp

Download

memory/3948-91-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp

Download

memory/3948-106-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp

Download

memory/3976-80-0x00007FF6C32B0000-0x00007FF6C3C32000-memory.dmp

Download

memory/4248-104-0x000001FFF84B0000-0x000001FFF84D0000-memory.dmp

Download