xmrig | ae97f3a84f6b0534e53010586a2cee9d92ce4471ad1a9dfd6eaaddea808d0314

Analysis

max time kernel
50s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/09/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neverlose.exe
Size 4.7MB
Sample260909-vkpsyach85
SHA256 ae97f3a84f6b0534e53010586a2cee9d92ce4471ad1a9dfd6eaaddea808d0314
MD5 2175090f63ca9a33b4defa39fd4c72b3
SHA1 bab14f826c636f0a07e115eeac47c6e700c4c389
SHA512 267c7f812c73e4a90814eee8873f69c25de3819a7d0c022ef9253e1c40c5055bed577413aa1407f110565315fbb3102bd12e202e4c85e60f7c955a5ea4aa8d45
SSDEEP 98304:vEcr6Q9iM2ZrTgKpXXk9QMDkqHoC6BhBc/mcLAgbiv07qebVbGGL:uzXWAXXkzkqHoC6BhBu8gGv07jRH
TLSH
T1EE363356D4816398D6DECCF74C032F533B69982ACED652C6DAB0A3CD429D3AD03D25CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral3/files/0x001900000002b55b-24.dat	family_xmrig_powershell_dropper

Executes dropped EXE 5 IoCs

pid	Process
1628	Neverlose.exe
1900	Main.exe
2512	Launcher.exe
2276	miner.exe
2480	Neverlose.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1768	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miner.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	powershell.exe
1768	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	Neverlose.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	Neverlose.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1628	4968	Neverlose.exe	80
PID 4968 wrote to memory of 1900	4968	Neverlose.exe	81
PID 1900 wrote to memory of 2512	1900	Main.exe	82
PID 1900 wrote to memory of 2276	1900	Main.exe	83
PID 1628 wrote to memory of 2480	1628	Neverlose.exe	87
PID 2276 wrote to memory of 3384	2276	miner.exe	88
PID 3384 wrote to memory of 1768	3384	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Neverlose.exe
  "C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Neverlose.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Neverlose.exe
    "C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Neverlose.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2480
- C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Main.exe
  "C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\91C9FD7B\miner.exe
    "C:\Users\Admin\AppData\Local\Temp\91C9FD7B\miner.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3A35.tmp\3A36.tmp\3A37.bat C:\Users\Admin\AppData\Local\Temp\91C9FD7B\miner.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "# ==============================================================================
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A37.bat

Path C:\Users\Admin\AppData\Local\Temp\3A35.tmp\3A36.tmp\3A37.bat
Size 9KB
SHA256 ba601ffbc70155e8af8a05b5a34c75da97f9710399d72290dd07d76a585d103f
MD5 8f8277b404b900acf6fdfbb262964aaa
SHA1 f45fe23628ecb393a9e69ab9eb536e6c553750bc
SHA512 b3267fcd8f1508c6e640b67efc10274b4bf15a1a7193f2dd78d70b6e1226437b43deb5a6df57c474cba01e8deffdaa18114b11ff4a5027be3a37b5bf0a136705
SSDEEP 192:nWP453YCrQij3AECxuC4DKxIH0gbtNBuo7JwX3sGPHCFiHhXSPkR:nWP4vQCsMXKiBNBRwxbBis
TLSH
T17912A415AA046326CABB6B1B8CC27305FD5B413B824B09C4B67CC154BFB4B9E8395CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Launcher.exe
Size 1.1MB
SHA256 a14a3fa38358fa0a6d09dc48d8d0957827b92adcb11f220d73e262777d8f414a
MD5 f3b39541326e063f298193febbd4840c
SHA1 d113df832f744ce082380c780162cacddef54da0
SHA512 34abda88bffc16eba848b64015dc74bc4024303ad02befba09f6de5d4b0bb394664483bfe42ed67af5cf4375aaf6c98fff107ee8c0c1bcc26765eacddba323c0
SSDEEP 12288:Tbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD/vfqItNqdg:TbOVE5ifGPRZwLvf3fd
TLSH
T150357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Neverlose.exe

Path C:\Users\Admin\AppData\Local\Temp\91C9FD7B\Neverlose.exe
Size 7.9MB
SHA256 0d6bb687052b6816de9bdbcaae3d512d6cf2316d881cc27488886fd76e720ac6
MD5 bf6f297ac0c32065299c397cee6a834b
SHA1 3a8f42cf99a10420e924b0086252788d55613486
SHA512 c4f2c82d6a5235aac3d85e1b74013c75dfeaf74ca24271fa32d572fcf70a087f148967564df9b84a257b01c775e96eeb035a973705158616afb3348f10853981
SSDEEP 98304:44kJ5kAImHKAlB0bIxSuBXCITC7xg83j/gU:44GkAlHKpbIHCgoxLz/gU
TLSH
T15886C007F756829DD016993887A2C357F371B8111B12A3CB72882A289FD77E01F7A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner.exe

Path C:\Users\Admin\AppData\Local\Temp\91C9FD7B\miner.exe
Size 98KB
SHA256 1e016fa4754ff0e4c7d71dc6264b3565a5e20bd5421f92788621d53cdf9b3b32
MD5 4ba7e07265ac2e1b1b3b1814d4238d5f
SHA1 3e90502a351091aec855097b7921db30bdfa2043
SHA512 536fa4e28e16f319c752650721fbb367e789dfc9889a4cad05b15f4f09a0ce32c691497cd43510c25504965a089a36d351014315f92ecc4a4adaf27d679a05a9
SSDEEP 1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfnwavfCVKOu:/7DhdC6kzWypvaQ0FxyNTBfnnKg
TLSH
T108A38D41F3E202F7E6F2053100A6626FD73A62389724E8DBC75C2D529913AD5A63D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Main.exe

Path C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Main.exe
Size 332KB
SHA256 bb31c0dec2288452fb3026e9b94a96d3f6f27d933a481cb7c2c371ead7a79dbb
MD5 c735d2cc26351e638f7197a7fb34a658
SHA1 8c9f565aa188604822e9c1263ccb06c02d5d06cf
SHA512 9b35f405fbe4c806854ddbbb392734a499c6247b9f4d6a337b12b48f5ab96a34ecee6a50432039a10ac66f26d42365d5bba332ea1b0f113828dca1fc06b91085
SSDEEP 6144:peSTTdvssD0yVyp5zuds+199Mni2aByDdPz45t5eWkGcMc+bIINEi41XSP:pzTTdvFVypQfunuByDK5t5eWbxkINEiJ
TLSH
T1DB74234BEEC1CAA4C070D530152BBD7FFF6E7F482372258F0BA96A1B4EE5600A571165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Neverlose.exe

Path C:\Users\Admin\AppData\Local\Temp\BBB9FD7B\Neverlose.exe
Size 4.4MB
SHA256 e1b00fb2170bf7408f0c8f0da94320740bb0e4e7a5174068922cc9e6f35a000f
MD5 bf56f7b5f52c29695e5ba44b3cdd8388
SHA1 f0cfd60432c6316cacafa2fdb375b18e44021fac
SHA512 2cb6f32f8b3e5564876940d90d65043b77b2f8f9b303aecf95397e03048ee463af0879c217eb20a4caa85a8874245687b0397fb000d15a15143c26b1d49c6c5c
SSDEEP 98304:eUw3afQeks44RMi8MZ1Tfk7uZXDihYAiwmEiSqI32nghkZq/+e+lUhq:e7KfQekPuPZ1I7mDiCEiy3ALe+l
TLSH
T163263308FDB3E550E84AD3353E5B7A3C9015B1CAB7C6E6C34EA8A5E72D3A7814643D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fc3lqozf.vkg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fc3lqozf.vkg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1768-31-0x00000164F4230000-0x00000164F4252000-memory.dmp

Download

memory/2276-20-0x0000000000417000-0x0000000000418000-memory.dmp

Download