xmrig | fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Size 16.8MB
Sample260925-ththnsfe28
SHA256 fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
MD5 4162ceedb9d8714c270eefce6b808cc0
SHA1 73e3bc25863fb4f0c6b835319db04630e9dfb712
SHA512 c5bf54c77f988acaee705ff8ddecae5426382742519a5c9632e8c1b9b8f2a4bfded7458099e4a2a9f7935e62d35f1210eddceb2ecaf46c30d47a50242402b1dd
SSDEEP 196608:yNtJUiM0r9wzksdY0gQn8qY3UpfKJFqiej:y7JUm9wndsQnjY3GUFqi
TLSH
T165078C43E8B605D9C1AE9276C66796237B743C894B3163C36B60B6342F77BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence spyware trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x00070000000242be-9.dat	family_xmrig
behavioral1/files/0x00070000000242be-9.dat	xmrig

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 5 IoCs

pid	Process
728	BootStrap.exe
1752	RuntimeBroker.exe
2336	WindowsUpdate.exe
4396	WindowsUpdate.exe
1248	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/files/0x00070000000242bb-4.dat	suspicious_telegram_bot

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1944	cmd.exe
3556	cmd.exe
3192	cmd.exe
4272	cmd.exe
2816	cmd.exe
3012	cmd.exe
3504	cmd.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3688	cmd.exe
3040	cmd.exe
4872	cmd.exe
1120	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 11 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootStrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe
4548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe
728	BootStrap.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1752	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	1752	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	1248	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	1248	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1752	RuntimeBroker.exe
1248	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1208	5004	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	87
PID 1208 wrote to memory of 1944	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	88
PID 1944 wrote to memory of 4492	1944	cmd.exe	90
PID 1208 wrote to memory of 3556	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	92
PID 3556 wrote to memory of 5044	3556	cmd.exe	94
PID 1208 wrote to memory of 3192	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	95
PID 3192 wrote to memory of 2168	3192	cmd.exe	97
PID 1208 wrote to memory of 4272	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	98
PID 4272 wrote to memory of 2084	4272	cmd.exe	100
PID 1208 wrote to memory of 2816	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	101
PID 2816 wrote to memory of 1708	2816	cmd.exe	103
PID 1208 wrote to memory of 4872	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	104
PID 4872 wrote to memory of 4132	4872	cmd.exe	106
PID 1208 wrote to memory of 1120	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	107
PID 1120 wrote to memory of 3876	1120	cmd.exe	109
PID 1208 wrote to memory of 3688	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	110
PID 3688 wrote to memory of 4128	3688	cmd.exe	112
PID 1208 wrote to memory of 3040	1208	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	114
PID 3040 wrote to memory of 4548	3040	cmd.exe	116
PID 5004 wrote to memory of 1752	5004	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	120
PID 728 wrote to memory of 2336	728	BootStrap.exe	124
PID 2336 wrote to memory of 4396	2336	WindowsUpdate.exe	125
PID 2336 wrote to memory of 1248	2336	WindowsUpdate.exe	126
PID 4396 wrote to memory of 3012	4396	WindowsUpdate.exe	128
PID 3012 wrote to memory of 2632	3012	cmd.exe	130
PID 4396 wrote to memory of 3504	4396	WindowsUpdate.exe	131
PID 3504 wrote to memory of 4248	3504	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2632	attrib.exe
4248	attrib.exe
4492	attrib.exe
5044	attrib.exe
2168	attrib.exe
2084	attrib.exe
1708	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
"C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
  C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe --persist-worker
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
      4⤵
      Views/modifies file attributes
      PID:4492
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
      4⤵
      Views/modifies file attributes
      PID:5044
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
      4⤵
      Views/modifies file attributes
      PID:2168
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\"
      4⤵
      Views/modifies file attributes
      PID:2084
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
      4⤵
      Views/modifies file attributes
      PID:1708
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f
      4⤵
      PID:4132
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\system32\reg.exe
      reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f
      4⤵
      PID:3876
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4548
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
        5⤵
        Views/modifies file attributes
        
        PID:2632
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
        5⤵
        Views/modifies file attributes
        
        PID:4248
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootStrap.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
Size 16.8MB
SHA256 fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
MD5 4162ceedb9d8714c270eefce6b808cc0
SHA1 73e3bc25863fb4f0c6b835319db04630e9dfb712
SHA512 c5bf54c77f988acaee705ff8ddecae5426382742519a5c9632e8c1b9b8f2a4bfded7458099e4a2a9f7935e62d35f1210eddceb2ecaf46c30d47a50242402b1dd
SSDEEP 196608:yNtJUiM0r9wzksdY0gQn8qY3UpfKJFqiej:y7JUm9wndsQnjY3GUFqi
TLSH
T165078C43E8B605D9C1AE9276C66796237B743C894B3163C36B60B6342F77BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
Size 6.1MB
SHA256 ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
MD5 5fba8ae226b096da3b31de0e17496735
SHA1 d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
SHA512 951e44fc0864a6741bcbb4227feb5429a032713dabd91102f4f0e27a69181ce7f23562e902cc09896ae26334b6d18caf0f5a13d81370bd703fd7ed6f78b47e72
SSDEEP 98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
TLSH
T15F569D5AB7A400E8C87AC93CC6479613E7B1B8165370A7DB17B4676A0F33AD51E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-11-0x000002A03C7E0000-0x000002A03C800000-memory.dmp

Download