xmrig | 6b1614b344b28032ad4f41170d5e32cdec64f1c161e3a7d9f2d5350355bfe738

Analysis

user interaction
yes
max time kernel
5s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lunar.cc.exe
Size 193KB
Sample260716-ff4zqsgy21
SHA256 6b1614b344b28032ad4f41170d5e32cdec64f1c161e3a7d9f2d5350355bfe738
MD5 3615dcb8c90ff21b94183819acdc9bd3
SHA1 f6eddb06286645e08fc35478b32d3d8ddd49bbb9
SHA512 3f67da9393427f6f42e991dc6885565c7a95e3d444b140be504b7a79daec00ecd9c6a08053f997cfa192cb4b0fec3cb8d07987ed89f008b023c4dcf73cd0c382
SSDEEP 3072:HFx7n9nyvNmXS82Qe5h6CQWpCf1o+kfP9etk4O/+6BrPfEO6846zyhl7:l/nyvgzKNQJ1DM4OT796Bkyhl7
TLSH
T130146D4A72F910F9F173C178C9A65616E33278651771ABEF07A006BA5F22AD09C3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4d5-46.dat	family_xmrig
behavioral2/files/0x000d00000001c4d5-46.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6080	powershell.exe
1396	powershell.exe
1128	powershell.exe
1732	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCache = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsCache\\WindowsUpdater.exe"	lunar.cc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
12	discord.com
14	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
6080	powershell.exe
6080	powershell.exe
1396	powershell.exe
1396	powershell.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeIncreaseQuotaPrivilege	1396	powershell.exe
Token: SeSecurityPrivilege	1396	powershell.exe
Token: SeTakeOwnershipPrivilege	1396	powershell.exe
Token: SeLoadDriverPrivilege	1396	powershell.exe
Token: SeSystemProfilePrivilege	1396	powershell.exe
Token: SeSystemtimePrivilege	1396	powershell.exe
Token: SeProfSingleProcessPrivilege	1396	powershell.exe
Token: SeIncBasePriorityPrivilege	1396	powershell.exe
Token: SeCreatePagefilePrivilege	1396	powershell.exe
Token: SeBackupPrivilege	1396	powershell.exe
Token: SeRestorePrivilege	1396	powershell.exe
Token: SeShutdownPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeSystemEnvironmentPrivilege	1396	powershell.exe
Token: SeRemoteShutdownPrivilege	1396	powershell.exe
Token: SeUndockPrivilege	1396	powershell.exe
Token: SeManageVolumePrivilege	1396	powershell.exe
Token: 33	1396	powershell.exe
Token: 34	1396	powershell.exe
Token: 35	1396	powershell.exe
Token: 36	1396	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 6080	4660	lunar.cc.exe	87
PID 6080 wrote to memory of 1396	6080	powershell.exe	89
PID 4660 wrote to memory of 1128	4660	lunar.cc.exe	91
PID 1128 wrote to memory of 1732	1128	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\lunar.cc.exe
"C:\Users\Admin\AppData\Local\Temp\lunar.cc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsCache'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\WindowsCache
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdater.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess WindowsUpdater.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1732
- C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe"
  2⤵
  PID:3624

C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uxfo2511.0gp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxfo2511.0gp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdater.exe

Path C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
Size 6.2MB
SHA256 3d9d5bbe6831e9eb4a3e12ae025518341504117af65f23e8ce8846044f4b0705
MD5 8e1bb504f94497c073aeeaaffd72f124
SHA1 d898e0e3ddba4cb74e6118f44221aee0ccc174b1
SHA512 e9543876306f287ebfc2373dcf6764e79cb74c8c87c663e3ec8e4fb0fd06645a595107affe39db7216d6188e6e3a38545690487ee0832fe0f252a163b111e39c
SSDEEP 98304:U7EO2slwQIaenHfjFAjN+avj0MjOsjEcaOxamtMQXfFF9UHmIiv+5JVi8VHtkS+O:U7EHSF9B+5S8VHNcuxpDz
TLSH
T16156AD65B7A400E8C86AC13CC65A9613E7F2F8195370A7DB1BB4567A1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-36-0x000001506AF30000-0x000001506AFE2000-memory.dmp

Download

memory/1396-37-0x000001506AD20000-0x000001506AD2A000-memory.dmp

Download

memory/1396-35-0x000001506AD00000-0x000001506AD1E000-memory.dmp

Download

memory/4416-48-0x0000023BF8DC0000-0x0000023BF8DE0000-memory.dmp

Download

memory/6080-5-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-12-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-11-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-8-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-7-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-0-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp

Download

memory/6080-6-0x000001AFE9CF0000-0x000001AFE9D12000-memory.dmp

Download

memory/6080-2-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-52-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/6080-1-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download