xmrig | 41af102372e7fde7400e0b985c400c2143573bc9088a11683f9cdd741f82dd1a

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_3d5c7761d94561f9f78b37ac2ecd283a_akira_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe
Size 9.0MB
Sample260711-t7kxtsft2p
SHA256 41af102372e7fde7400e0b985c400c2143573bc9088a11683f9cdd741f82dd1a
MD5 3d5c7761d94561f9f78b37ac2ecd283a
SHA1 31216340606ace1359e0a1f704ad319dba1726ad
SHA512 f7679bc5c543b69f0b1f9e00e1e4f2b5a336f258b0a97ee71acd85a978d2df00126d1df70b6380d2c25bbcb4cde42c6bd75f8c3ae96e2de94d7ae4c29df44873
SSDEEP 98304:di0X7PT8mBS32G78btNvqICzu40d9bcRIBO5iPTYsrhfe+yIlKgbdzWbO:dtbQOSH78yuh9M6lKOdzf
TLSH
T1BA968E57F9A144F9C06AD23186676262BB31BC490B3277E72F90A7343F72BD05A39B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/3844-7-0x00007FF7B1050000-0x00007FF7B149B000-memory.dmp	xmrig
behavioral2/memory/3844-8-0x00007FF7B1050000-0x00007FF7B149B000-memory.dmp	xmrig

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5140	rundll32.exe
4	5140	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5140	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	WebViewEdge.exe

Loads dropped DLL 1 IoCs

pid	Process
5140	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5140 set thread context of 3844	5140	rundll32.exe	94

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4824	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4824	4144	2026-07-11_3d5c7761d94561f9f78b37ac2ecd283a_akira_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe	88
PID 4860 wrote to memory of 5140	4860	WebViewEdge.exe	93
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94
PID 5140 wrote to memory of 3844	5140	rundll32.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-11_3d5c7761d94561f9f78b37ac2ecd283a_akira_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_3d5c7761d94561f9f78b37ac2ecd283a_akira_frostygoop_ghostlocker_glassworm_hive_knight_luca-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\schtasks.exe
  schtasks /Create /TN WebViewEdge /TR C:\ProgramData\WebViewUpdate\WebViewEdge.exe /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4824

C:\ProgramData\WebViewUpdate\WebViewEdge.exe
C:\ProgramData\WebViewUpdate\WebViewEdge.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\ProgramData\WebViewUpdate\webview.dll,main
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    3⤵
    PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebViewEdge.exe

Path C:\ProgramData\WebViewUpdate\WebViewEdge.exe
Size 2.4MB
SHA256 46af34c56d5b9228d7e02561ae98a8d13e13c9b171d04ba2b7144633bf36e187
MD5 4df545f843be0da3879e554512e764fb
SHA1 4f56f872ef530d5f75b1bd0fef6dfec86d0d1aaa
SHA512 299dc57176757aea300a921eb143f09865042ef360d78dab9805351a242747df94b464df97f3c8c1add179e20df9bc096ed00b5a79522171c4126023fa01812d
SSDEEP 24576:iySl6nhyDVFkcaGfpGmRkqwsG2U/z40n2tZctmBke1Xi07C7Gk3JFTGtJXBWcFA:i5whyDVhfpGzT28mBk2Ve7V3bTGtdG
TLSH
T1D0C57C17BCD118BAC4AA933289A662927B71BC491F3233D72E50B73C2FB36D05975790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webview.dll

Path C:\ProgramData\WebViewUpdate\webview.dll
Size 3.5MB
SHA256 4015c1c20d5c3bc65efd84fb3582b6b1c9e398ccecabbc7647620ad502ec18b0
MD5 df4b58440567238624732db34cde980b
SHA1 3c36540edd60339fc774fa2d55516a4407e32629
SHA512 fefe1ce047f98eafc6da8703008a2fc2ca4d4f211d2eb4a9b843411ee0641b132b9c425762921b345e0b2c3e96c0167bf99a8bf9bbac4a5bceb5a7c10df26782
SSDEEP 98304:s8btNvqICzu40d9bcRIBO5iPTYsrhfe+:s8yuh9M
TLSH
T198064A53F66281A9C069C074930B6632FA72BC8D4735BAFB5BD087313E55BD06A3CB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3844-7-0x00007FF7B1050000-0x00007FF7B149B000-memory.dmp

Download

memory/3844-8-0x00007FF7B1050000-0x00007FF7B149B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads