Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 07:29
General
- Target 30039d7a93bee3c08830fd502975e1f9af1786bd519a4f613a452dce6e792efc.exe
- Size 3.1MB
- Sample260720-jbe2lacx7x
- SHA256 30039d7a93bee3c08830fd502975e1f9af1786bd519a4f613a452dce6e792efc
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 32 IoCs
- Executes dropped EXE 7 IoCs
- UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30039d7a93bee3c08830fd502975e1f9af1786bd519a4f613a452dce6e792efc.exe"C:\Users\Admin\AppData\Local\Temp\30039d7a93bee3c08830fd502975e1f9af1786bd519a4f613a452dce6e792efc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\EXMR\start.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\EXMR\nssm.exenssm.exe install csrrs csrrs.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Public\EXMR\nssm.exenssm.exe start csrrs3⤵
- Executes dropped EXE
-
-
C:\Users\Public\EXMR\csrrs.execsrrs.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\x\csres.exeC:\ProgramData\x\csres.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Users\Public\EXMR\nssm.exeC:\Users\Public\EXMR\nssm.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\EXMR\csrrs.exe"csrrs.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\x\csres.exeC:\ProgramData\x\csres.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WinRing0x64.sys
config.json
csres.exe
csrrs.exe
nssm.exe
start.bat
memory/1572-59-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-55-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-69-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-41-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-42-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-67-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-65-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-45-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-63-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-47-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-61-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-49-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-20-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-51-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-57-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/1572-53-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/2884-31-0x0000023851550000-0x0000023851570000-memory.dmp
memory/5240-62-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-64-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-52-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-58-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-50-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-60-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-56-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-48-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-46-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-54-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-44-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-66-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-43-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-68-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-34-0x0000000000400000-0x0000000000B3D000-memory.dmp
memory/5240-70-0x0000000000400000-0x0000000000B3D000-memory.dmp