xmrig | 17e7f0170795c2e704077570333a1f0985b190c016d372d6b70a41e170302cdb

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_865d4f3e8fa37c05.exe
Size 11.6MB
Sample260824-phbkmstscw
SHA256 17e7f0170795c2e704077570333a1f0985b190c016d372d6b70a41e170302cdb
MD5 d5adbf5818d010611ad223ae7d81c601
SHA1 8b88d9da7dcd641a01382613cf19754937d95b3f
SHA512 26cb66aac2b29b96e71386836b70bffbfec5b9ee6da1538c4028e4273baacadd0adb843adb8790b6724d157036ba08646f87d6495a1433f1f04ca29daed8cb71
SSDEEP 196608:NkAFUzeSCKDin2Ex3dW5ltDOvV4x6xwhG/WvbWzw8BAxMaXZLqJ:5IDo/45ltD7x6OhYMbp8BASaJLqJ
TLSH
T142C6F14369DB0DE9CED667B861C35335A778FD358A291F3BAB08C23169532C4AD1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2408 created 5688	2408	RuntimeBroker_28512841.exe	81
PID 2408 created 5688	2408	RuntimeBroker_28512841.exe	81

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4c3-5.dat	family_xmrig
behavioral2/files/0x000d00000001c4c3-5.dat	xmrig
behavioral2/memory/2408-9-0x00007FF78D1A0000-0x00007FF78DAB0000-memory.dmp	xmrig
behavioral2/memory/1204-13-0x00007FF65CB20000-0x00007FF65D430000-memory.dmp	xmrig
behavioral2/memory/4404-15-0x00007FF781170000-0x00007FF781A57000-memory.dmp	xmrig
behavioral2/memory/2408-17-0x00007FF78D1A0000-0x00007FF78DAB0000-memory.dmp	xmrig
behavioral2/memory/5632-18-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-20-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-22-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-24-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-26-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-28-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-30-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig
behavioral2/memory/5632-32-0x00007FF791610000-0x00007FF791EF7000-memory.dmp	xmrig

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	4404	cmd.exe
16	5632	cmd.exe
17	5632	cmd.exe
19	5632	cmd.exe
20	5632	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2408	RuntimeBroker_28512841.exe
1204	RuntimeBroker_28512841.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 4404	2408	RuntimeBroker_28512841.exe	94
PID 2408 set thread context of 5632	2408	RuntimeBroker_28512841.exe	95

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker_28512841.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker_28512841.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe
2408	RuntimeBroker_28512841.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4404	cmd.exe
Token: SeLockMemoryPrivilege	4404	cmd.exe
Token: SeLockMemoryPrivilege	5632	cmd.exe
Token: SeLockMemoryPrivilege	5632	cmd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4404	cmd.exe
5632	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2408	4332	file_865d4f3e8fa37c05.exe	90
PID 2408 wrote to memory of 4404	2408	RuntimeBroker_28512841.exe	94
PID 2408 wrote to memory of 5632	2408	RuntimeBroker_28512841.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5688
- C:\Users\Admin\AppData\Local\Temp\file_865d4f3e8fa37c05.exe
  "C:\Users\Admin\AppData\Local\Temp\file_865d4f3e8fa37c05.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_28512841.exe
    C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_28512841.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2408
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e310b02054039091f471e365e595a5a7244401c4e7553281c2433570a5f34002835272d763c003b0b73322e332b782e082c04281e3b3c361306351e3803091e18342e335b1b14023609072325561d0a241b0d3b583f13271d0758102e170a5b382107233e160b0b2e090356345f5d75363b101961491d49166149401d02324440440d311140040f394919011c2405091a43290d031d5373544d440f611615465e
  2⤵
  - Badlisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4404
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e310b02054039091f471e365e595a5a7244401c4e7553281c2433570a5f34002835272d763c003b0b73322e332b782e082c04281e3b3c361306351e3803091e18342e335b1b14023609072325561d0a241b0d3b583f13271d0758102e170a5b382107233e160b0b2e090356345f5d75363b101961491d49166149401d02324440440d311140040f394919011c2405091a43290d031d5373544d440f611615465e
  2⤵
  - Badlisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5632

C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker_28512841.exe
C:\Users\Admin\AppData\Roaming\Microsoft\RuntimeBroker_28512841.exe
1⤵
- Executes dropped EXE
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker_28512841.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker_28512841.exe
Size 9.0MB
SHA256 ba60bbfb58466e3722ed6a38a66085ca918bef5436064801bef96f25d3ba570a
MD5 8d46005bd1f007c81e922f75b44bd2c0
SHA1 bf6186c09a4611658e1f177eba109e859e66c3ae
SHA512 3250a6457b75322fb89ccb05c6de71977fedf0178a99d4ce7780af1b6b32c0ae648d1e24abcadc7e000f87664b22deaf3984bdcdb08fc0f71810ae513125b433
SSDEEP 98304:RBdDJE3PWfG7ONynwzwp2MRsCPp9LCBVEDb+F7qr3S4PtBrj5kmXQZxnQ/Dc662V:BJE3PWfXN/ZxQc6fba4oU75W4h9yc7
TLSH
T180967CA7E2E150D8C86FC17886469233E6B1B8585330F7DF1A64D72A1F23AD05B3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-13-0x00007FF65CB20000-0x00007FF65D430000-memory.dmp

Download

memory/2408-17-0x00007FF78D1A0000-0x00007FF78DAB0000-memory.dmp

Download

memory/2408-8-0x00000212B3790000-0x00000212B3791000-memory.dmp

Download

memory/2408-9-0x00007FF78D1A0000-0x00007FF78DAB0000-memory.dmp

Download

memory/4332-6-0x00007FF65D490000-0x00007FF65D5A2000-memory.dmp

Download

memory/4332-0-0x00007FF65D490000-0x00007FF65D5A2000-memory.dmp

Download

memory/4404-14-0x0000018873500000-0x0000018873520000-memory.dmp

Download

memory/4404-15-0x00007FF781170000-0x00007FF781A57000-memory.dmp

Download

memory/5632-18-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-20-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-22-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-24-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-26-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-28-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-30-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download

memory/5632-32-0x00007FF791610000-0x00007FF791EF7000-memory.dmp

Download