xmrig | 6b61177f52a0bb6b2cc4f3a3c5b773e50aaa4b636d8aa1c26a7d68a6e96a5202

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slinky.exe
Size 47KB
Sample260721-l2rt7acw2l
SHA256 6b61177f52a0bb6b2cc4f3a3c5b773e50aaa4b636d8aa1c26a7d68a6e96a5202
MD5 38abfe25a8ef9182601e410653457d8d
SHA1 a398375ae48e62a20d315e277b9b4c8ccedc0fbe
SHA512 dd177481ce20e89d1707ccd863f7ffa332c32847a392c7eb38d96bff6f54ce4f157728863b6273550e382a98db11254e1a1be90865604598b41ae96d71bc358e
SSDEEP 768:UjnCxakym8xACyv9NsqPYMlhZRuZgDo3c05uGmfxgcp:s7hyEqpbuZgDoX5ulqW
TLSH
T1FA239415CD16A16BF379CD78C5134805AE63BCC6CBB5A5CBE3480DE20B67AD49B39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c561-48.dat	family_xmrig
behavioral2/files/0x000d00000001c561-48.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1968	powershell.exe
4832	powershell.exe
2984	powershell.exe
4656	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3132	WindowsUpdater.exe
6024	WindowsUpdater.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCache = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsCache\\WindowsUpdater.exe"	slinky.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	discord.com
26	discord.com
6	discord.com
17	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4960	slinky.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeLockMemoryPrivilege	3132	WindowsUpdater.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeLockMemoryPrivilege	3132	WindowsUpdater.exe
Token: SeIncreaseQuotaPrivilege	4832	powershell.exe
Token: SeSecurityPrivilege	4832	powershell.exe
Token: SeTakeOwnershipPrivilege	4832	powershell.exe
Token: SeLoadDriverPrivilege	4832	powershell.exe
Token: SeSystemProfilePrivilege	4832	powershell.exe
Token: SeSystemtimePrivilege	4832	powershell.exe
Token: SeProfSingleProcessPrivilege	4832	powershell.exe
Token: SeIncBasePriorityPrivilege	4832	powershell.exe
Token: SeCreatePagefilePrivilege	4832	powershell.exe
Token: SeBackupPrivilege	4832	powershell.exe
Token: SeRestorePrivilege	4832	powershell.exe
Token: SeShutdownPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeSystemEnvironmentPrivilege	4832	powershell.exe
Token: SeRemoteShutdownPrivilege	4832	powershell.exe
Token: SeUndockPrivilege	4832	powershell.exe
Token: SeManageVolumePrivilege	4832	powershell.exe
Token: 33	4832	powershell.exe
Token: 34	4832	powershell.exe
Token: 35	4832	powershell.exe
Token: 36	4832	powershell.exe
Token: SeLockMemoryPrivilege	6024	WindowsUpdater.exe
Token: SeLockMemoryPrivilege	6024	WindowsUpdater.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3132	WindowsUpdater.exe
6024	WindowsUpdater.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2984	4960	slinky.exe	90
PID 2984 wrote to memory of 4656	2984	powershell.exe	92
PID 4960 wrote to memory of 1968	4960	slinky.exe	95
PID 1968 wrote to memory of 4832	1968	powershell.exe	98
PID 4960 wrote to memory of 6024	4960	slinky.exe	100

C:\Users\Admin\AppData\Local\Temp\slinky.exe
"C:\Users\Admin\AppData\Local\Temp\slinky.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsCache'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\WindowsCache
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdater.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess WindowsUpdater.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6024

C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_kfvq1mkz.nrl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kfvq1mkz.nrl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsUpdater.exe

Path C:\Users\Admin\AppData\Roaming\WindowsCache\WindowsUpdater.exe
Size 6.2MB
SHA256 3d9d5bbe6831e9eb4a3e12ae025518341504117af65f23e8ce8846044f4b0705
MD5 8e1bb504f94497c073aeeaaffd72f124
SHA1 d898e0e3ddba4cb74e6118f44221aee0ccc174b1
SHA512 e9543876306f287ebfc2373dcf6764e79cb74c8c87c663e3ec8e4fb0fd06645a595107affe39db7216d6188e6e3a38545690487ee0832fe0f252a163b111e39c
SSDEEP 98304:U7EO2slwQIaenHfjFAjN+avj0MjOsjEcaOxamtMQXfFF9UHmIiv+5JVi8VHtkS+O:U7EHSF9B+5S8VHNcuxpDz
TLSH
T16156AD65B7A400E8C86AC13CC65A9613E7F2F8195370A7DB1BB4567A1F33AD41E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-17-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-13-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp

Download

memory/2984-16-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-15-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-3-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-1-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-2-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-37-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp

Download

memory/2984-4-0x000002C925C90000-0x000002C925CB2000-memory.dmp

Download

memory/3132-50-0x000001C9DCCC0000-0x000001C9DCCE0000-memory.dmp

Download

memory/4656-33-0x000001C9F34E0000-0x000001C9F34EA000-memory.dmp

Download

memory/4656-32-0x000001C9F3210000-0x000001C9F32C2000-memory.dmp

Download

memory/4656-31-0x000001C9F31F0000-0x000001C9F320E000-memory.dmp

Download

memory/4832-55-0x0000020673F20000-0x0000020673FD2000-memory.dmp

Download