Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 22:34
General
- Target file.exe
- Size 2.9MB
- Sample260722-2hba4a11ds
- SHA256 1d233362395405a19be5da8fc1f3fba060e658fb30718a47eedc0925a7226e52
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- XMRig Miner payload 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Drops file in System32 directory 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry class 6 IoCs
- NTFS ADS 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Windows security bypass
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript.exe //B "C:\ProgramData\NVDisplay\~DF0E59260C.tmp"2⤵
-
-
C:\ProgramData\NVDisplay\Win32Container.exe"C:\ProgramData\NVDisplay\Win32Container.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\~DF0E5930BB.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 43⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\ProgramData\NVDisplay\Win32Container.exe"C:\ProgramData\NVDisplay\Win32Container.exe"1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ARM\ARMHelper.exe"C:\ProgramData\ARM\ARMHelper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\NVDisplay\Win32Container.exe"C:\ProgramData\NVDisplay\Win32Container.exe" -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
Win32Container.exe
fudcrypt_stub.log
fudcrypt_stub.log
fudcrypt_stub.log
~DF0E5930BB.bat
appcache.dll
memory/2112-117-0x000001B5A6C20000-0x000001B5A6C40000-memory.dmp
memory/2112-91-0x000001B5A4C80000-0x000001B5A4CA0000-memory.dmp
memory/2112-85-0x000001B5A5150000-0x000001B5A5407000-memory.dmp
memory/2112-86-0x000001B5A5150000-0x000001B5A5407000-memory.dmp
memory/2112-88-0x000001B5A5150000-0x000001B5A5407000-memory.dmp
memory/2112-87-0x000001B5A5150000-0x000001B5A5407000-memory.dmp
memory/2112-77-0x000001B5A5150000-0x000001B5A5407000-memory.dmp
memory/2592-138-0x000001B3EC690000-0x000001B3EC947000-memory.dmp
memory/2592-147-0x000001B3EC690000-0x000001B3EC947000-memory.dmp
memory/2592-148-0x000001B3EC690000-0x000001B3EC947000-memory.dmp
memory/2592-149-0x000001B3EC690000-0x000001B3EC947000-memory.dmp
memory/2592-146-0x000001B3EC690000-0x000001B3EC947000-memory.dmp
memory/3068-63-0x0000020D0D010000-0x0000020D0D2C7000-memory.dmp
memory/3068-62-0x0000020D0D010000-0x0000020D0D2C7000-memory.dmp
memory/3068-64-0x0000020D0D010000-0x0000020D0D2C7000-memory.dmp
memory/3068-61-0x0000020D0D010000-0x0000020D0D2C7000-memory.dmp
memory/3068-53-0x0000020D0D010000-0x0000020D0D2C7000-memory.dmp
memory/4192-126-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-20-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-21-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-18-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-19-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-121-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4192-10-0x000002156A830000-0x000002156AAE7000-memory.dmp
memory/4812-112-0x000002A5A5190000-0x000002A5A5447000-memory.dmp
memory/4812-104-0x000002A5A5190000-0x000002A5A5447000-memory.dmp
memory/4812-115-0x000002A5A5190000-0x000002A5A5447000-memory.dmp
memory/4812-116-0x000002A5A5190000-0x000002A5A5447000-memory.dmp
memory/4812-113-0x000002A5A5190000-0x000002A5A5447000-memory.dmp
memory/4812-114-0x000002A5A5190000-0x000002A5A5447000-memory.dmp