Analysis
- user interaction
yes - max time kernel
898s - max time network
901s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
19/09/2026, 14:56
General
- Target 688a70e7bda8bd48deba9891f5c707ce37bf374710de01a6dd6a66345ea1985a.ps1
- Size 904B
- Sample260919-sbb5dagf37
- SHA256 688a70e7bda8bd48deba9891f5c707ce37bf374710de01a6dd6a66345ea1985a
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 64 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\688a70e7bda8bd48deba9891f5c707ce37bf374710de01a6dd6a66345ea1985a.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" -o gulf.moneroocean.stream:20004 -u 46T7e9jdAxDNFoGAbkgmAZJn7qJDGdBjca9UeoMEgvuC7uka76cVnvc5Jr8FHmF7zmALAZYbBDG5mS62yo64WPpy2kaKqMz --rig-id rig08 --keepalive --tls2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_14judhfa.3rp.ps1
xmrig.exe
memory/968-0-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/968-1-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/968-9-0x0000024AE3BE0000-0x0000024AE3C02000-memory.dmp
memory/968-10-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/968-11-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/968-12-0x0000024AE4720000-0x0000024AE48E2000-memory.dmp
memory/968-13-0x0000024AE4E20000-0x0000024AE5348000-memory.dmp
memory/968-15-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/968-16-0x0000024AE3FE0000-0x0000024AE3FF2000-memory.dmp
memory/968-17-0x0000024AE3FD0000-0x0000024AE3FDA000-memory.dmp
memory/968-32-0x0000024AC9780000-0x0000024AC9790000-memory.dmp
memory/1664-29-0x000001C1A5DF0000-0x000001C1A5E10000-memory.dmp
memory/1664-31-0x000001C1A5E50000-0x000001C1A5E54000-memory.dmp
memory/1664-30-0x000001C1A5E40000-0x000001C1A5E44000-memory.dmp
memory/1664-34-0x000001C1A5E40000-0x000001C1A5E44000-memory.dmp
memory/1664-33-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-36-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-37-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-38-0x000001C1A66D0000-0x000001C1A66D4000-memory.dmp
memory/1664-40-0x000001C1A66D0000-0x000001C1A66D4000-memory.dmp
memory/1664-39-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-41-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-42-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-43-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-44-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-45-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-46-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-47-0x000001C1A5FF0000-0x000001C1A6010000-memory.dmp
memory/1664-48-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-49-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-50-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-51-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-52-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-53-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-54-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-55-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-56-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-57-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-58-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-59-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-60-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-61-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-62-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-63-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-64-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-65-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-66-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-67-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-68-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-69-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-70-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-71-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-72-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-73-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-74-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-75-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-76-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-77-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-78-0x000001C1A6110000-0x000001C1A6130000-memory.dmp
memory/1664-79-0x000001C1A6130000-0x000001C1A6150000-memory.dmp
memory/1664-80-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-81-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-82-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-83-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-84-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-85-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-86-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-87-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-88-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-89-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-90-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-91-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-92-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-93-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-94-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-95-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-96-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-97-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-98-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-99-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-100-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-101-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-102-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-103-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-104-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-105-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-106-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-107-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-108-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-109-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-110-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-111-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-112-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-113-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-114-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-115-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-116-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-117-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-118-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-119-0x00007FF75E490000-0x00007FF75F140000-memory.dmp
memory/1664-120-0x00007FF75E490000-0x00007FF75F140000-memory.dmp