xmrig | 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Size 10.4MB
Sample260708-wpb83sd18p
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xmrig miner persistence ransomware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c5fd-0.dat	family_xmrig
behavioral2/files/0x000d00000001c5fd-0.dat	xmrig
behavioral2/memory/1500-1-0x00007FF720B10000-0x00007FF721492000-memory.dmp	xmrig
behavioral2/memory/4280-3-0x00007FF65FD00000-0x00007FF660682000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c60f-31.dat	family_xmrig
behavioral2/files/0x000c00000001c60f-31.dat	xmrig
behavioral2/memory/5880-35-0x00007FF65FD00000-0x00007FF660682000-memory.dmp	xmrig

Clears Windows event logs 1 TTPs 2 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2496	wevtutil.exe
616	wevtutil.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 3 IoCs

pid	Process
5880	svchost.exe
4280	svchost.exe
5896	svchost32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host Process = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost\\svchost.exe"	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5360	schtasks.exe
1540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe
5880	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeSecurityPrivilege	616	wevtutil.exe
Token: SeBackupPrivilege	616	wevtutil.exe
Token: SeSecurityPrivilege	2496	wevtutil.exe
Token: SeBackupPrivilege	2496	wevtutil.exe
Token: SeLockMemoryPrivilege	5896	svchost32.exe
Token: SeLockMemoryPrivilege	5896	svchost32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5896	svchost32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 896	1500	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	88
PID 1500 wrote to memory of 3392	1500	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	90
PID 896 wrote to memory of 5360	896	cmd.exe	92
PID 3392 wrote to memory of 616	3392	cmd.exe	93
PID 1500 wrote to memory of 5880	1500	2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe	95
PID 5880 wrote to memory of 5856	5880	svchost.exe	96
PID 5880 wrote to memory of 4952	5880	svchost.exe	99
PID 5856 wrote to memory of 1540	5856	cmd.exe	101
PID 4952 wrote to memory of 2496	4952	cmd.exe	102
PID 5880 wrote to memory of 5896	5880	svchost.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Windows-Security"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1540
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows-Security"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
    "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5896

C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
1⤵
- Executes dropped EXE
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Roaming\WindowsHost\config.json
Size 2KB
SHA256 9b97a6774eb28fd3d52829ea443085376c168c5b9681519a14fe273398767369
MD5 b97be153137f5d44161ede820bfb3e86
SHA1 01dd63af973f7e99266d58769a3110e971d38183
SHA512 42b07b9a6409829c7583ac6b0d1f82e8eaa12248271c77038c589f5b48f24fc15f2a30fd45e2ea544bdae257410b0d35801839abf6407c4767c0379cbf66f0c5
TLSH
T12D51D325C9600CFF19B9A15C96B4B393DA69831B23410C3F75FC995C2F37A36B142BA9
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
Size 10.4MB
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost32.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
Size 8.7MB
SHA256 070e24574b5252e5bab26d0a87e041e171104dcc786101a2322a0d0bd1988f23
MD5 ebd618f13938643dbb3a2814e7bb6e4a
SHA1 f596735903337e21e1a82bbfabdf3a93fa842931
SHA512 4efeecab8b620d55001a08f415cb394296cd82bfed7fa8cf09d74874116bdd95dbf0b6ae9a4d6f793dc0f39f8fec2ce98f5f2a7ff35cb6efc2b3b7dc0658f3ac
SSDEEP 196608:A/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+k:AkFCUatKWEe6J+FeK/Ra+NMxBk
TLSH
T14496CF16B7A400E8C87AC53CC64A9513E7B1B81953B0A7DB26F4967A1F33BD41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-1-0x00007FF720B10000-0x00007FF721492000-memory.dmp

Download

memory/4280-3-0x00007FF65FD00000-0x00007FF660682000-memory.dmp

Download

memory/5880-35-0x00007FF65FD00000-0x00007FF660682000-memory.dmp

Download

memory/5896-33-0x0000027A7FB00000-0x0000027A7FB20000-memory.dmp

Download