xmrig | ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527

Analysis

max time kernel
135s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe
Size 1.1MB
Sample260930-kxczssbc53
SHA256 ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527
MD5 a0ec6765cd28803df8ccc8ba4b42c24f
SHA1 9cf718c42135817068ba24a99ddc941270c4d845
SHA512 2358ccfb49e5190c0086f0ea1ce8619dcc95d36ef77b3cfaf2060706452f57633e9f8892d1d3577d9a1dff59774fccf474ac0f54f6e7c56a4094e1ba0d1dde6a
SSDEEP 24576:BBAkFRYd+yrg7tdZhHFZzOkx4xbXLmzs6jIQvqj4PYQWDUSF:BBYd9kdZ5FZKk8vmlIQSjAYQWDP
TLSH
T1C73533CD10510959E85A5A3F87A26EBC74972A74AE722D2C1E04FBE538F25607FC3C27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000011382-27.dat	family_xmrig
behavioral2/files/0x0008000000011382-27.dat	xmrig

Executes dropped EXE 3 IoCs

pid	Process
2876	SareicahUI.exe
4376	rar.exe
4136	SaericahUI.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x0000000000400000-0x000000000078C000-memory.dmp	upx
behavioral2/memory/3696-9-0x0000000000400000-0x000000000078C000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\hao1151_2.rar	SareicahUI.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\rar.exe	SareicahUI.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\xmr.exe	rar.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\xmr.exe	rar.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\WinRing0x64.sys	rar.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\WinRing0x64.sys	rar.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\hao1151_2.exe	rar.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\hao1151_2.exe	rar.exe
File created	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\SareicahUI.exe	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
696	cmd.exe
3052	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SareicahUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SareicahUI.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SareicahUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
696	cmd.exe
3448	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5796	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3448	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe
2876	SareicahUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5796	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3696	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe
3696	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe
2876	SareicahUI.exe
2876	SareicahUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 2876	3696	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe	88
PID 3696 wrote to memory of 696	3696	ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe	89
PID 696 wrote to memory of 5796	696	cmd.exe	91
PID 696 wrote to memory of 3448	696	cmd.exe	93
PID 2876 wrote to memory of 4376	2876	SareicahUI.exe	95
PID 2876 wrote to memory of 4136	2876	SareicahUI.exe	97

C:\Users\Admin\AppData\Local\Temp\ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe
"C:\Users\Admin\AppData\Local\Temp\ddf0665a78cc558a6ec18662f9534dfeb4b84dd54ce3d920a979d87ed8895527.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\SareicahUI.exe
  C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\SareicahUI.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\rar.exe
    "rar.exe" x -iext -ow -o+ "hao1151_2.rar" "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4376
- - C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\SaericahUI.exe
    SaericahUI.exe --algorithm pearlhash --pool stratum+ssl://4.hao1151.com:18013 --wallet prl1phs6s7m983309a6pz7qdreq8x6usschwxc5ujalp0lzvzyptjghlsc52549.SER4
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c set
      4⤵
      Executes a command shell one-liner
      PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /pid 3696 &ping 127.0.0.1 -n 1 &rd /s /q C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 3696
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SareicahUI.exe

Path C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\SareicahUI.exe
Size 2.6MB
SHA256 9c22edef196f3dc8793c67112620aa81d833b36eaef3700c95a437c7948b41f3
MD5 27d7f9545333319c51044dc3d33eb4e3
SHA1 0c6e40c96c3786e622556fabd56b3fe34044e4e9
SHA512 cb930e05993c621b621ebd618ef79416a5fb020230d68954616f472556de19f75f9fba794494ccf840c9feb4139108c0b129ef7178f3277fb8667054dfe51157
SSDEEP 24576:ng54TG0XXmCeKwszWnr4NRz0yWCU8xMczxNo596didOVXofUytipjUytzyUytnZs:n00peKwMqyzZNzs5cpxyZy9RytVg
TLSH
T125D5C001F782C0B5F54515B055FA573EEA3A97150B308BC7D3D8ED792E222E2AA3325B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hao1151_2.exe

Path C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\hao1151_2.exe
Size 31.3MB
SHA256 224f882da1c5e000dec7350225746e32c7ff7edd7265ad4ff879b8295ba9c192
MD5 8ad658dce006777108308f1ff075a004
SHA1 f7ae7edaad4d290045c7f1fc8a0903cc54605281
SHA512 e95f21693bc5d3fe3eb9ae9c324bb3accee5e5d041a784a4fef18ac603964b957e3e2b309c8eb7b7cf34260d3df0408b3fb363675fda97c78b8a97c66772c23b
SSDEEP 786432:85mYX4KNbXGOJrO1svQe591R29XCC8qneWrU1B0Mxfqz:85TXfSOxAsvZHAZk+e8U1B0Uf
TLSH
T1FB7733F72E4B9AABE187617EDCCC9C1836DC0E5B6E9292DC585C362BC44F00199F861D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hao1151_2.rar

Path C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\hao1151_2.rar
Size 33.1MB
SHA256 8ee2f5147fc1268e9dc9220f7ed5261519ace8139b646e25ca47faf8fd00a8d1
MD5 318ecc2d61b18857443013f10db48554
SHA1 608f80de7bebc90c5bf30d4f6bd7c3f44a9fc914
SHA512 eb9d0bbabad367eea1d72015f39f31fb73dc306a02fc804c8394b51df332ce6b235c1b2b0cc85e3c87cdc3e3b98c509193d6c3ac78c254bad4e6d6cd6e9cfe9c
SSDEEP 786432:1B6XsGesH4sYPugCv17M7sWyO6Zorl3v+ThXIoiN:1IXLtH4/7g7Mod7ZIlfAxiN
TLSH
T162773311DB82AFF41275229F908EBD3DBC6EE518CAC135AD7054C297AD7B190983DAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\rar.exe
Size 551KB
SHA256 06159de0077f8a7f03eeccc3bbd499d6941476b4a0d2e164b94e01e89907ce9a
MD5 c4d1ff896853a227c3c528861cf976d0
SHA1 a724d035c70cac1052daa66ca06d1b46d30f9a17
SHA512 2af42f5c6f908c61b3eb1e752e7cec7b161a4580838f358d5bac2abf4974dbe1f1baef186d96b7ba620f6a9058d6af01d2e5f4118f726504342e7a9a1567b116
SSDEEP 12288:vs5W3eDU8xMR6rzxNouKjxfLkvdnAG03dOVXoNn:vyWCU8xMczxNo596didOVXo9
TLSH
T16CC4AF10BEC2C1B2C9551570666E972F793EA614073149EBA3D80D693E236E31F36BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmr.exe

Path C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\xmr.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3696-9-0x0000000000400000-0x000000000078C000-memory.dmp

Download

memory/3696-0-0x0000000000400000-0x000000000078C000-memory.dmp

Download

memory/3696-1-0x000000000078B000-0x000000000078C000-memory.dmp

Download

memory/4136-29-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download

memory/4136-30-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download

memory/4136-32-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download

memory/4136-31-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download

memory/4136-33-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download

memory/4136-44-0x00007FF679FF0000-0x00007FF67D282000-memory.dmp

Download