Analysis
- max time kernel
898s - max time network
895s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 08:14
General
- Target tungtung.ps1
- Size 1KB
- Sample260724-j49rnsvgph
- SHA256 0bd76089e9a297d1e6d323f2ac43788ac57898fcbbd18548d097830b629185ac
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\tungtung.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\xmrig\xmrig-6.26.0\xmrig.exe"C:\Users\Admin\Desktop\xmrig\xmrig-6.26.0\xmrig.exe" -a rx/0 -o pool.hashvault.pro:443 -u 8AdDAwd7vZpPJvn5gVULXFBAvQeudVchgJGdH47pWaBvPjRmafuToc7Ghsoh6qAVJShUEjEz5GqLQcbjgWswsK7VTKMkefV -p tung-tung --cpu-priority 5 -t 2 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --donate-level 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zrbexwj4.o4c.ps1
xmrig.exe
memory/1144-75-0x000001F117ED0000-0x000001F117EF0000-memory.dmp
memory/1144-76-0x000001F117F10000-0x000001F117F30000-memory.dmp
memory/1144-73-0x000001F117EB0000-0x000001F117ED0000-memory.dmp
memory/1144-71-0x000001F117F10000-0x000001F117F30000-memory.dmp
memory/1144-70-0x000001F117ED0000-0x000001F117EF0000-memory.dmp
memory/1144-63-0x000001F117E60000-0x000001F117E80000-memory.dmp
memory/5540-18-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-33-0x00000268DACF0000-0x00000268DAD02000-memory.dmp
memory/5540-12-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-13-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-14-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-15-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-16-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-17-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-22-0x00000268DAC00000-0x00000268DACB2000-memory.dmp
memory/5540-23-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-21-0x00000268DABC0000-0x00000268DABDE000-memory.dmp
memory/5540-26-0x00000268DACF0000-0x00000268DAD14000-memory.dmp
memory/5540-25-0x00000268DACF0000-0x00000268DAD1A000-memory.dmp
memory/5540-24-0x00000268DABE0000-0x00000268DABEA000-memory.dmp
memory/5540-0-0x00000268C236C000-0x00000268C236D000-memory.dmp
memory/5540-27-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-29-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-10-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-32-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-11-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-34-0x00000268DACE0000-0x00000268DACEA000-memory.dmp
memory/5540-47-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-9-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-8-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-64-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-66-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-67-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-69-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-7-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-6-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-72-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-5-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-4-0x00000268C26C0000-0x00000268C26E2000-memory.dmp
memory/5540-1-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-83-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-85-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-135-0x00000268C1BD0000-0x00000268C2574000-memory.dmp
memory/5540-137-0x00000268C1BD0000-0x00000268C2574000-memory.dmp