xmrig | 6c15eae0b664116f3e3ba33a336942c1acea16b2b4714194193c557277c21cd3

Analysis

user interaction
yes
max time kernel
34s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hack_game.exe
Size 17.8MB
Sample260818-aesmesscrd
SHA256 6c15eae0b664116f3e3ba33a336942c1acea16b2b4714194193c557277c21cd3
MD5 86039eab9066e1fe59b9d774fd40e2e0
SHA1 c400a3e98e27387de7d314d758a784d9ef28c754
SHA512 c714b4a64374cf442efff974f3e58abe65f73b4e645ff41f3c295b0c74218f918d82c1145c7b8f9efe54720092e93890f4d6ecd0f06e7a723842fe8b74775faf
SSDEEP 49152:YWnkxxDGVTagPm0Ii3X4x81LezTv33Fii3VjjJlsvnY0JZcX21zbJA+UsqgaVZ+T:7BR
TLSH
T13E177D269F805B89E6DC0CABC07D2A1B6AF36780D0B3F2CD67926503269FE1C573955C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/568-3-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig
behavioral1/memory/568-13-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig
behavioral1/memory/568-19-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig
behavioral1/memory/568-22-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig
behavioral1/memory/568-24-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig
behavioral1/memory/568-26-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp	xmrig

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	568	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3452	MSIwindowsI.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3452 set thread context of 568	3452	MSIwindowsI.exe	85

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe	hack_game.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2888	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	MSIwindowsI.exe
3452	MSIwindowsI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	568	powershell.exe
Token: SeLockMemoryPrivilege	568	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
568	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2888	2668	hack_game.exe	80
PID 2888 wrote to memory of 4056	2888	cmd.exe	82
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85
PID 3452 wrote to memory of 568	3452	MSIwindowsI.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\hack_game.exe
"C:\Users\Admin\AppData\Local\Temp\hack_game.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn "system86" /tr "\"C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe\"" /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn "system86" /tr "\"C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe\"" /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4056

C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe
"C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSIwindowsI.exe

Path C:\Program Files (x86)\Microsoft.NET\MSIwindowsI.exe
Size 12.6MB
SHA256 8d1891763b0a1cf90b14479939288c429745eb91c6941fdfa1ba050407363df7
MD5 830828a7fc0d692f3b11f5bb7f7b57b6
SHA1 eadebbe0583a195b0dace5df785362f048549270
SHA512 0c0fa6b8cea69c4b547282742775a208735d68853c91775b7a17c288e997524e237990ef621b82f7ad363e7b272d25f9d119fcb69f436562edaec09518ff2ea5
SSDEEP 49152:4ht5PW5Ydr2My9h4H1bB6DTGPkI/pkAhq6oMcpvDOv6rzVM9JjfXjIupwNWAptpk:o
TLSH
T1AFD68DB706277CDE39B80D96A00125855C2D3A4B657DD546FCC830FFA3FA2A48E29E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-3-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/568-13-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/568-19-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/568-20-0x000002B1474C0000-0x000002B1474E0000-memory.dmp

Download

memory/568-22-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/568-24-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/568-26-0x00007FF76EBF0000-0x00007FF76F867000-memory.dmp

Download

memory/2668-21-0x00007FF70EE20000-0x00007FF70FFEF000-memory.dmp

Download

memory/2668-23-0x00007FF70EE20000-0x00007FF70FFEF000-memory.dmp

Download

memory/2668-25-0x00007FF70EE20000-0x00007FF70FFEF000-memory.dmp

Download

memory/3452-6-0x00007FF6CD220000-0x00007FF6CDEBF000-memory.dmp

Download