Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 22:04
General
- Target 2026-09-22_1f7589c421230c4949db31a954ffe1cf_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc_xmrig.exe
- Size 8.4MB
- Sample260922-1zbgratbnd
- SHA256 8501f680085d4d0d75482bbd14f5223e5c3ddd19470f98961113b0f8e9466956
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- XMRig Miner payload 16 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_1f7589c421230c4949db31a954ffe1cf_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_1f7589c421230c4949db31a954ffe1cf_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc_xmrig.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b61505928577314042a242806593b0b34105c2d1c2f57082c0625172f2c22750e5a5d0c2c1e1a1e1702233825140f3e3c191c2837091a1d333c20013e70160c03347600550a2b100e2f2f24192614383a14125b110d1b20191f292a30340e56124440194e220b1f1f1b324440441a2d174d44432214184403201c401d0633010c0d1d6c0c04071a7c5d5d494320441f1141712⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b61505928577314042a242806593b0b34105c2d1c2f57082c0625172f2c22750e5a5d0c2c1e1a1e1702233825140f3e3c191c2837091a1d333c20013e70160c03347600550a2b100e2f2f24192614383a14125b110d1b20191f292a30340e56124440194e220b1f1f1b324440441a2d174d44432214184403201c401d0633010c0d1d6c0c04071a7c5d5d494320441f1141712⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2268-13-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-18-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-32-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-30-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-5-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-7-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-9-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-11-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-28-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-26-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-16-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-20-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-22-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2268-24-0x00007FF690390000-0x00007FF690C77000-memory.dmp
memory/2908-0-0x0000019D9C790000-0x0000019D9C791000-memory.dmp
memory/2908-4-0x00007FF6587B0000-0x00007FF659019000-memory.dmp
memory/5936-1-0x00000183EDEB0000-0x00000183EDED0000-memory.dmp
memory/5936-2-0x00007FF7360A0000-0x00007FF736987000-memory.dmp