Overview

overview

10

Static

static

10

260822-ym4...ed.zip

windows10-2004-x64

1

260822-ym4...ed.zip

windows11-ltsc_2024-x64

1

2026-08-21...ig.exe

windows10-2004-x64

8

2026-08-21...ig.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe
  • Size 9.8MB
  • Sample260822-ysbstsyemb
  • SHA256 3939817a6e82b672cfedcbe5c6ad3c643bd1008e784e89505f8af9e1365b1ce4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
command_and_controldefense_evasiondiscoveryexecutionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (75219) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • XMRig Miner payload 1 IoCs
    miner
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Outbound SSH connection to public host 2 TTPs 64 IoCs

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Connections Discovery 1 TTPs 4 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe"
    1⤵
    • Loads dropped DLL
    • Outbound SSH connection to public host
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6840
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc stop npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5316
      • C:\Windows\system32\sc.exe
        sc stop npf
        3⤵
        • Launches sc.exe
        PID:1632
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc delete npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\system32\sc.exe
        sc delete npf
        3⤵
        • Launches sc.exe
        PID:5216
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Windows\system32\sc.exe
        sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys
        3⤵
        • Launches sc.exe
        PID:7096
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc start npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\system32\sc.exe
        sc start npf
        3⤵
        • Launches sc.exe
        PID:2452
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "netstat -ano | findstr TCP"
      2⤵
      • Executes a command shell one-liner
      • System Network Connections Discovery
      • Suspicious use of WriteProcessMemory
      PID:3352
      • C:\Windows\system32\NETSTAT.EXE
        netstat -ano
        3⤵
        • System Network Connections Discovery
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4268
      • C:\Windows\system32\findstr.exe
        findstr TCP
        3⤵
          PID:6844
      • C:\Windows\system32\cmd.exe
        cmd.exe /c "netstat -ano | findstr TCP"
        2⤵
        • Executes a command shell one-liner
        • System Network Connections Discovery
        • Suspicious use of WriteProcessMemory
        PID:6476
        • C:\Windows\system32\NETSTAT.EXE
          netstat -ano
          3⤵
          • System Network Connections Discovery
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:4912
        • C:\Windows\system32\findstr.exe
          findstr TCP
          3⤵
            PID:4924
        • C:\Windows\system32\cmd.exe
          cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\y4iylh\kthreaddk.exe
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2576
          • C:\Users\Admin\AppData\Local\Temp\y4iylh\kthreaddk.exe
            C:\Users\Admin\AppData\Local\Temp\y4iylh\kthreaddk.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:7164

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Packet.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Packet.dll
            • Size 105KB
            • SHA256 ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wpcap.dll
            • Path C:\Users\Admin\AppData\Local\Temp\wpcap.dll
            • Size 361KB
            • SHA256 35aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\Temp\y4iylh\config.json
            • Size 1KB
            • SHA256 54f0d371f9918c81e3ce7a557d6da1ac4639995c5a6e409822f0e496d3a1d290
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            kthreaddk.exe
            • Path C:\Users\Admin\AppData\Local\Temp\y4iylh\kthreaddk.exe
            • Size 2.0MB
            • SHA256 a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/6840-9-0x0000000002940000-0x000000000295F000-memory.dmp
            Download

            memory/7164-19-0x0000022E51B50000-0x0000022E51B64000-memory.dmp
            Download