xmrig | 44b5a3d437f5e67a9ccb4cd1f6d841a02cad083467a7f7205c0ed604bb1cab02

Resubmissions

09/10/2026, 12:27

261009-pmx97sgs7110

09/10/2026, 12:25

261009-pl1zpsev6q10

Analysis

user interaction
yes
max time kernel
40s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 14.0MB
Sample261009-pmx97sgs71
SHA256 44b5a3d437f5e67a9ccb4cd1f6d841a02cad083467a7f7205c0ed604bb1cab02
MD5 27a36f799b7933667d6459f765873edc
SHA1 01d168203d2c78f6ba58ee56843f840d8573003a
SHA512 46e48e3f7052d47f1f6a30235c493b03e4f12f1bb21cf21f93898ead3fa1e2e5ce94d26b5ac73d55ccb77e9f5e3baa244ef3bdd936218533f858751ce14b50a9
SSDEEP 393216:hl//WtS7UAcMXIX0Df57CcvCS2bmtnavBP5:LG47UAcMweHvphnm
TLSH
T1F5E633391BB034C8FE43D93D342549569DBCAE4A1031D1AF3A46F9A2D1BECC1EC2569E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c577-151.dat	family_xmrig
behavioral2/files/0x000d00000001c58e-158.dat	family_xmrig
behavioral2/files/0x000d00000001c58e-158.dat	xmrig

Executes dropped EXE 3 IoCs

pid	Process
2604	loader.exe
5076	loader.exe
6136	loader.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
1	raw.githubusercontent.com
7	raw.githubusercontent.com
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 816	4584	loader.exe	89

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe
3724	cmd.exe
2836	cmd.exe
6096	cmd.exe
4320	cmd.exe
6036	cmd.exe
5948	cmd.exe
3264	cmd.exe
6068	cmd.exe
4788	cmd.exe
1916	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2736	schtasks.exe
3812	schtasks.exe
4956	schtasks.exe
1292	schtasks.exe
5092	schtasks.exe
5768	schtasks.exe
1512	schtasks.exe
4476	schtasks.exe
3716	schtasks.exe
2984	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 4584 wrote to memory of 816	4584	loader.exe	89
PID 816 wrote to memory of 2604	816	notepad.exe	90
PID 816 wrote to memory of 5076	816	notepad.exe	91
PID 816 wrote to memory of 6136	816	notepad.exe	92

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    C:\Users\Admin\AppData\Local\Temp\loader.exe --persist-worker
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:2316
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    C:\Users\Admin\AppData\Local\Temp\loader.exe --guard 816
    3⤵
    - Executes dropped EXE
    PID:5076
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe --persist-worker
        5⤵
        
        PID:4940
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:2292
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f"
        5⤵
        Executes a command shell one-liner
        
        PID:2836
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4476
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f"
        5⤵
        Executes a command shell one-liner
        
        PID:6068
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 5224
        5⤵
        
        PID:2824
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 5224 2824
        5⤵
        
        PID:1580
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:5160
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f"
        5⤵
        Executes a command shell one-liner
        
        PID:1916
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3716
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    C:\Users\Admin\AppData\Local\Temp\loader.exe --gravedigger 816 5076
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe --persist-worker
        5⤵
        
        PID:6128
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:2344
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f"
        5⤵
        Executes a command shell one-liner
        
        PID:3724
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f"
        5⤵
        Executes a command shell one-liner
        
        PID:6096
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3812
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 4840
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 4840 5240
        5⤵
        
        PID:5988
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f"
        5⤵
        Executes a command shell one-liner
        
        PID:6036
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2736
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    PID:4116
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4956
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f"
    3⤵
    - Executes a command shell one-liner
    PID:5948
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5768
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f"
    3⤵
    - Executes a command shell one-liner
    PID:3264
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 816
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 816 4672
    3⤵
    PID:2696

C:\Users\Admin\AppData\Local\Temp\loader.exe
C:\Users\Admin\AppData\Local\Temp\loader.exe
1⤵
PID:4600
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    C:\Users\Admin\AppData\Local\Temp\loader.exe --persist-worker
    3⤵
    PID:3040
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:4404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 1832
    3⤵
    PID:1332
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
        5⤵
        
        PID:5136
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 1832 1332
    3⤵
    PID:6108
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4788
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"RuntimeBrokerHb\" /tr \"\\\"\" + wd + \"\\\"\" /sc minute /mo 10 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1292
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4320
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"RuntimeBrokerBt\" /tr \"\\\"\" + exe + \"\\\"\" /sc onstart /delay 0000:30 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2984

C:\Windows\system32\schtasks.exe
schtasks /create /tn \"RuntimeBroker\" /tr \"\\\"\" + exe + \"\\\"\" /sc onlogon /rl highest /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
1⤵
PID:744

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2448 2316
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinServiceCheck.pyw

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WinServiceCheck.pyw
Size 423B
SHA256 9f81d7b392dae7a8c2de1bc5ce1ab58bb901961c3ece7e39336da3a534fd57e5
MD5 367e5376101b89bcc7e07ba909c547f5
SHA1 b317643e0254d083d384b986eb6bd80c57996ab3
SHA512 dc1b08db4ee02db44c4fa9f26b61626f137ccfbda2628e508f1ca9cb5cc87618d3dbe992252a06ccbacc4a73716f467606e9cb0a73d995a08389c96c59ef8451
TLSH
T1EFE0AB40C62E062552B19462292075B18FC35C13434B9630F58CC71A3FC641AD105A07
MD5 SHA1 SHA512 TLSH

Submit Download

WinServiceHost.bat

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WinServiceHost.bat
Size 299B
SHA256 2551b581ef69af40b243f9a22d062c1daa3aa0744843cee08066481c36767662
MD5 a6e580954f1bc421944977bd5d4087ab
SHA1 0b8be0c52513622dc8f976f38ddd374c2e5962b1
SHA512 594184f467f1bc02664e67d577727cb8c83f8e090ceb7369fbc625ef643bf47d9cc4626d8d8326e0fbc3f6a818759e09575f5e92b37f8ffbfe66f30b550c0eb5
TLSH
T1AAE07D000097D66D057168134DDA9FC730C34817072B73400152C44DCEDE92FD9C73C2
MD5 SHA1 SHA512 TLSH

Submit Download

ResetConfig.xml

Path C:\Users\Admin\AppData\Local\Temp\Recovery\OEM\ResetConfig.xml
Size 963B
SHA256 501a89104ab38c77738c7387a2270eaf7bc3d6791806c3e72617d115954a8cfd
MD5 e8bda16b41bc0e4171c3919b65f6004a
SHA1 e6d60ae60e22dec604b41eb324950e54611ce537
SHA512 daa1c0cb340acf5d720a55d613973309fb57dc7cfc9423e04d24fbf2b96da69c3bf1b94b66eb7ba1641fea6d24c74bb8d9a0c6052cbc2b3317a417d4a77e6b4a
TLSH
T10911AF90D4FCE427F8204C61C3579B108FE0A31FA04671667CAC1DED5F668817A67673
MD5 SHA1 SHA512 TLSH

Submit Download

RestoreApp.cmd

Path C:\Users\Admin\AppData\Local\Temp\Recovery\OEM\RestoreApp.cmd
Size 133B
SHA256 8ccb04a64210c149b9caca33778e539da926170bbf4361fa1a054e82065ca0de
MD5 16fa47f122642f69e908153d44259333
SHA1 a73c7e3cf2ce3a0a14f56b1240986961d1239d10
SHA512 62659d71758d6c5bf5af1ca29981880fc3ab1448302a0584c6a5ea7ff67bbea712a2e894f3b15470c72a88ca78aa7f78e6a06f07eae707bfdc8c9330372a0850
TLSH
T1D0C02B000045867F1D324C0104D34BCB709205CF4F0577400702841C86CDC0DF9CA200
MD5 SHA1 SHA512 TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 6.2MB
SHA256 a0a0da39da2fac453b4b0cc642c9f452e7f1e389f99f1cf57a5df1961200215e
MD5 d156e6de734e6592e7a44f6cab242aa4
SHA1 5fc180fcdb3924d8b1ac7c0324d34b5696ff3829
SHA512 d1dc4e942ee6bd843d21b8a373a8efc0fed49993c515b134361a42bb3329c2c6d28293b34c1e554c6d97248557799612903ac728484564e83bd1d0ac308bc790
SSDEEP 196608:0Obl//ZJ+LChjFSUvsEYh7Achii136dUCZ:hl//WtS7UAcMl
TLSH
T1026633302BE064C8E902DB3D723045267D5EAA5AC532C7297E5EED52437E4D3AC2E4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 10.5MB
SHA256 541cd76e3661d280f966be7779423cafed4bde83ac45f0a6ea14da0a9911cb7d
MD5 6b478971fb13b8f8b4b2f6eef2d5b810
SHA1 96830444a16bb963492584dfb8c938051801288e
SHA512 168aff16b6ad424ad81861d6d23c566ddd8d8eb372494b7c097dbca5e25d176bd191f3318a1e5100ea21f3a44814886cc15a8031541619ab0e660990b8313e13
SSDEEP 196608:0Obl//ZJ+LChjFSUvsEYh7Achii136dUCrIX0Dgg57CAQs6M/nCSo8yNg1:hl//WtS7UAcMXIX0Df57CcvCS20
TLSH
T1BDB633342BF034C8FE03963D766105265EBCDB154431D1AA7E5AF966C27E8C2A8319BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 14.0MB
SHA256 44b5a3d437f5e67a9ccb4cd1f6d841a02cad083467a7f7205c0ed604bb1cab02
MD5 27a36f799b7933667d6459f765873edc
SHA1 01d168203d2c78f6ba58ee56843f840d8573003a
SHA512 46e48e3f7052d47f1f6a30235c493b03e4f12f1bb21cf21f93898ead3fa1e2e5ce94d26b5ac73d55ccb77e9f5e3baa244ef3bdd936218533f858751ce14b50a9
SSDEEP 393216:hl//WtS7UAcMXIX0Df57CcvCS2bmtnavBP5:LG47UAcMweHvphnm
TLSH
T1F5E633391BB034C8FE43D93D342549569DBCAE4A1031D1AF3A46F9A2D1BECC1EC2569E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 10.6MB
SHA256 0b7737bc139c10d56849f28f34888cf33ad968b07d03d91d2864a5b3bfbc900a
MD5 06fd5696edcdde7d37a24f5cd241ac5b
SHA1 248d9c316c40287d9aa314d981c15bdc77b268c7
SHA512 809d8b5a96756413a97f01946223a36e0017be4bb23221d123cdeff684ab5124d77a4f423979c4df040f00986f60879c1de6331d30f74e87064d832a2425ed2f
SSDEEP 196608:0Obl//ZJ+LChjFSUvsEYh7Achii136dUCrIX0Dgg57CAQs6M/nCSo8yNglb:hl//WtS7UAcMXIX0Df57CcvCS2Q
TLSH
T1CAB633341BE034C8FE03963D766105265EBCDB055031D1AA7E5EF966D27F8C2A831ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.didy_mid

Path C:\Users\Admin\AppData\Roaming\.didy_mid
Size 16B
SHA256 7a70f04c57040a614fe129fb7d91481b4b09511ace05ccf2fcb6cd4e5fb59806
MD5 84ad3505cd5d30428468477e9ec0d4a9
SHA1 93b4adf6847fff3230042eeb6f25268d614170be
SHA512 facdf98e80dfb90cfa8872d67ec0bcc8d886260978ba5cdefc7863c13c6e0fa8deaa6a20b69018b07891aa38742c3bac93b6291b5ff9b9daead8ad3a1fabf94d
MD5 SHA1 SHA512

Submit Download

SgrmBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\SgrmBroker.exe
Size 5.9MB
SHA256 38d4f08733f9bd8bc42ee575fccbeeb9cf68c4fdcc367bd0ce24a746e696cd67
MD5 dd247ee24872b7ea21c895dd76269523
SHA1 397c5da2eeacedd6c8cb5ffe71c38e8173714791
SHA512 9b714e6bf2f08ef6e73d18fcabb71191e27c186ab420dd6bb2810e56893dd98fb206dd2ba60f8c7b79f177e851cb36fbd50638be0bd14ab529aab2addf0840a5
SSDEEP 98304:gONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6/:4XlivZqOXmtubmxl5ppvEzT6/
TLSH
T1B5569D5AB7A400E8C87AC93C86479613E7F1B81A5370A7DB17B4576A0F23BD51E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\SgrmBroker.exe
Size 896KB
SHA256 e8b84a2878b6139139e6d26d67167f113da8cb5c1245e6f6762d14521b558e30
MD5 ea01e2c5db99f9ca6d886a6c53744902
SHA1 09242a69956ac7d04fe5d52c4a81fd81acfc2572
SHA512 b2d64113019ef5840083dac6c2c2256d4a9e920d996b2bf2f3bbac4fb6fcae1103c9039848ac68eb3ad297da46a53727de892d17a6102abb1c83996274383932
SSDEEP 24576:7drsJ21KkPwTILAXzx0LBX6LzW0cVhxBykfGvXoo:GXOBXMzXA3oksXd
TLSH
T12A158E1B25B540E9D4BFD0BC8E0B9D5BE7B178494370BADF16E046A61F63AE0193EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Widgets.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
Size 4.9MB
SHA256 b1ea3263dd5edd48308d7e99d800f0a368af5671d0c311e457df9b9276896b05
MD5 89ab522101646eb0abe5df4ca754705c
SHA1 b09c4aa3cfdb05c66cc86004c82c4b428dd41962
SHA512 0c32bf8b3dee2c788c09248c0bb58b2cf121e92710386e9f1a25da0a36a5980f45e82ab7b4ad0930fe232e72620fc914cbcb6a751c437230db4329ca6239afb3
SSDEEP 98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtXr:GXlivZqOXmtubmxl5pb
TLSH
T119368C5AA7F410E8D8BAC138C6478517E7F1B8195370ABDB06A457BA0F33AD15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Widgets.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
Size 320KB
SHA256 454ec32ff71944c4890062933bc78a05e18923c2ec95bad75ca8b001653885bd
MD5 ec4e75620e7f1f695abec3bb4d607dd4
SHA1 d81a85f34d4e8df23aee9fceefa510661dcf2f04
SHA512 368c2ff5ca9f105103f35b0802ea78787a5fed7840feade4686062491129b38eb0823f6a098d7bb281f1a734cd735955214a9cd82b9cdbf81ba978caada85c30
SSDEEP 6144:w+hNcQUhV591Z6SsN0sBEPI24JsJ21KkPwTILAB2u1tp5zx5XRsk:w+pGV59unB5bsJ21KkPwTILK2sXzx9RV
TLSH
T1A3647C2B26A540F8D0BAD0BCCE57DA47E7B2B45A4361A6DF22F053A61F239E0157F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 4.8MB
SHA256 38c1a6480fdd7053aba93948d76e45a3b4286bfa256fec23fcdb43540465707d
MD5 69489d9a76e0ac84f8cecfef1333b02a
SHA1 3be52b4a8894668b1699b63a6b9a970ca8cea5cd
SHA512 d82cf546a5a2fb07c75e4adfc470343eebcc5709a0cdab3a114dd7364bc0f9ab65df528b2cb7fcdcf864b2ccceb06d5c396484ae4160c3c2b609f0be24eda3f5
SSDEEP 98304:0Obl+PCF/uUOeMQOsmOr+LCSW7ZjtPH3CqbVT7sEYpX7uzRccQvMSkiATIffK:0Obl//ZJ+LChjFSUvsEYh7Achii13K
TLSH
T13A36333127E420C4EA018A3E7231551A6D6E5E5ECD32D7697E5AFC2B123D9C22C2F1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 5.2MB
SHA256 8bd5ddf075aaf6565297d4cf14e016287c21aac71af3d165bed3148ac0ef0587
MD5 aefbd46be4b99e706e59ca2d46fe6e3c
SHA1 2adea33a9ff9eaf87d660a338ea721dca43dd82b
SHA512 7921725a391b26b61cf41585904fb620179797bcd07559d3bc4809b1c81890786c27eb9cc4ec04fd3704cbf90ebd0067af860096208ec0d784bb67ca8fb805f7
SSDEEP 98304:0Obl+PCF/uUOeMQOsmOr+LCSW7ZjtPH3CqbVT7sEYpX7uzRccQvMSkiATIff6dFe:0Obl//ZJ+LChjFSUvsEYh7Achii136do
TLSH
T1DB46333027D424C8EA01C73E7231562A6D1E5E5E9A32C7197A6AFC17437D9D26C2F1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 5.3MB
SHA256 23cdeffea8b985097bf7ac765af7e060fd2d855c0c5ebb00f0a7e4276573f1fa
MD5 65f8d7861afeccbfc2e9ecac6eacb056
SHA1 e5a7d8bc095c6823a3420385541a817229cc281e
SHA512 01eb2c902554652ffd2c5c657b3be693b93973bf04f80344080d53fee33db31aadf561578225f45d2473a4f88b218a361b0a0a2c40e90a35ad1668b8412acd29
SSDEEP 98304:0Obl+PCF/uUOeMQOsmOr+LCSW7ZjtPH3CqbVT7sEYpX7uzRccQvMSkiATIff6dFH:0Obl//ZJ+LChjFSUvsEYh7Achii136dl
TLSH
T19346333027E464C8EA01C73E7231562A6D1E5E9E9A32C6197E5AFC17427D8D26C2F4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 7.2MB
SHA256 135ea8a01ee0c49052512310038163cb651cdbf7c37417c900e8054e33855b8d
MD5 1adbdadfa15390eddb9b1e1a76945db5
SHA1 aa89ab53ebe643fec0979da5e0c29c498670fe44
SHA512 2f0dcbe7550c6894c1ebdc2ac5929a541c34000af7876f9c8f50a289fbd67f167966184f4678b91a8d850344e8719cd925350edb01ea32df6e6d064bd61b9a99
SSDEEP 196608:0Obl//ZJ+LChjFSUvsEYh7Achii136dUCrIXt:hl//WtS7UAcMXIXt
TLSH
T1C476333027E074C8E901EB3E7330052A6DAD9A178531C6193D5EFC5683BE9D3993A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 7.4MB
SHA256 1df1866f9ee0be2c8c52cf3f28d0a4e98cb6df140724ac2aefb26090dfe425b4
MD5 bfbd994d109792815739eed00f9b8ead
SHA1 007d030cf155a1c874020014d369875ccf2fec0a
SHA512 8826dc57ac1aa786218c065f98cdb8357f81dfdac2c1a0777e408f3e6f32421542c4b3427c3822f1e9540f0df0a9a7efadeeaec48d21938a0dab5e041ee0f815
SSDEEP 196608:0Obl//ZJ+LChjFSUvsEYh7Achii136dUCrIXQ:hl//WtS7UAcMXIXQ
TLSH
T12276333027E074C8ED02EB3E7331052A6DED96578531C6593D4EF85643BE8C2993A9AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 5.0MB
SHA256 36c176cd4d267e4701f4b168f76772e45a153a844f2f5141fc1af7d7fe4428c2
MD5 53b19a7cd712faa1333b455f2a997911
SHA1 c3f3dc9cfb62ea5ad451389532706b8f8e023756
SHA512 f596a78728465729d729484c0ed8b5f9a2f49ad6eb125d29fd93b09b559e36aad73b668ff94d700e58302a751cadd9d2a144c4337f5a6334853b95f8df706867
SSDEEP 98304:0Obl+PCF/uUOeMQOsmOr+LCSW7ZjtPH3CqbVT7sEYpX7uzRccQvMSkiATIff6O:0Obl//ZJ+LChjFSUvsEYh7Achii136O
TLSH
T1EF36333127D410C4E9018A3E7231562A6D6E5E5E8A32C7297E9AFC1B437D9D26C3F1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 832KB
SHA256 f4d95ff0e5b4b95ae6b0920c56dac640644e4ff71e79a08242a19f6b30cce0b3
MD5 27c2ea28de04dadc1946a213765157e8
SHA1 510fdd2a8059aa9de4498ac9832bda4f8a4858e5
SHA512 84f9b4478e32ea7925ea84762f048480f297dddd10f30b40da8fd969629b143b6f25897aeec67fe46e0b27a5ef4fc5c938488df6b9932b739076bc8c354142db
SSDEEP 24576:LgidtlVXVPmDDIp5MNZHuWprBDGO2KdzUKWtJ:0idtlVl+D8p5MCF/uUZJ
TLSH
T1E905333C73C4B5C5D149C038F072EBAF221AB95D143AC674FEA98923916A4976D2FC6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 448KB
SHA256 11fe5e91478989524ff3b02fbf7c3b9e81cae4104039c19ecdd1c05879f504a3
MD5 004caf43b8e31d3858bd007caa536aea
SHA1 bdb6cace2f24fd9cfa78464d48fcd62a6364341e
SHA512 2b51e857ed2de2263a7777d3b288cc74fc756ae78f0487dc40703e479755e8496f3dc135043a6ae340b3e1b97c5e75a2f7c6bf78505178b0b4a334a8ed4afdbe
SSDEEP 12288:Lgidt5/xrv7XBz1FhhBgDD1GF955MgaOFU5wN:LgidtlVXVPmDDIp5MNZ8
TLSH
T144A42335B1C0F4C5C20681387023BF6B162D744EA525DB6E7F16492A9A2BFE52F4ED88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 384KB
SHA256 ea86c16e8ea0e30492a9254a5744225c70193eb593700f9874fbf0d8032756a1
MD5 a5ffb331a8c3cc7ab74d16e9722fb517
SHA1 51d4b4aa99562c818ac805568c41e4edf1bf7392
SHA512 3bcf39050ab033693d1cf0f1b83a74be25f8231015d0daf1194e40951a56d89d72725d7460909add1e95a84a2d6ec29150db42287068b77f3fc4d7cc7d2e7a9c
SSDEEP 6144:LgiCdgthbv/xz6GKEL9v76+aOLxz1Ff/xPZBsq66ED1A3zcqD9TrNP5X8v2i0:Lgidt5/xrv7XBz1FhhBgDD1GF955M+
TLSH
T163842330B1C1F5C5C20282747023DF2F122A745EA136D76B7F15462A896BF9A2F9FC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
Size 512KB
SHA256 711b56c75fc2a185be42edda802f1193fefb6f6d885a717d510e31665a56de12
MD5 a6210007dff231f83fdc5b7ce21e425a
SHA1 7abd2aad9ed6d73ce6a74f85b11b298c47c2206e
SHA512 b6453f7a767e766b3e4d5020b6d10c70c99fe77f8859bc66fce4694120ff1670afbc03bd023412235da83dc097a3040ec19cf1f82e980bb94fcda20c2b888e8a
SSDEEP 12288:Lgidt5/xrv7XBz1FhhBgDD1GF955MgaOFU5wyuWZ:LgidtlVXVPmDDIp5MNZHuWZ
TLSH
T19BB42339B1C1F0C4C10681347033EF6F161D750E9529DAAABE96452AE65FEEA1F8EC4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupComplete.cmd

Path C:\Windows\Setup\Scripts\SetupComplete.cmd
Size 438B
SHA256 05fc37c543b84ebd41127b08f24dc93dd7f2938e2649c66b2cb7d86fb0378a0c
MD5 f83026be8861be3de6eb9329233ac1c9
SHA1 3663bd8452f469d3f65762d9fdf4b0bfcdfc697c
SHA512 41db3e1c7e439c178e99ddd2420afbf58d748ede452a1efd9a7d922fdb6715947801e956009a6c99ee6fc726b7db9de32879bcb8c4664e9d533b78c18992cee0
TLSH
T1FFF05C05688FCE2B4521B86304E79EDBB2F3070F1D1A7B804392801CA5CA90ED9D7781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-3-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-1-0x00000190D5EA0000-0x00000190D5EA1000-memory.dmp

Download

memory/816-4-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-0-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-104-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-2-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-8-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/816-5-0x00007FF9D5E60000-0x00007FF9D60C3000-memory.dmp

Download

memory/1832-121-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/1832-136-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/1832-150-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2292-96-0x0000015787700000-0x0000015787701000-memory.dmp

Download

memory/2292-97-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2292-109-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2316-32-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2316-88-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2316-31-0x000001EEB6F00000-0x000001EEB6F01000-memory.dmp

Download

memory/2316-33-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2316-34-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2344-103-0x00000173708F0000-0x00000173708F1000-memory.dmp

Download

memory/2344-114-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2344-107-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/2448-207-0x00000237D4D30000-0x00000237D4D31000-memory.dmp

Download

memory/4308-202-0x00000133FE0F0000-0x00000133FE0F1000-memory.dmp

Download

memory/4404-173-0x0000012D32C10000-0x0000012D32C11000-memory.dmp

Download

memory/4404-175-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4404-178-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4404-176-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4404-174-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4548-152-0x00000298FDA80000-0x00000298FDAA0000-memory.dmp

Download

memory/4584-86-0x00007FF67E8A0000-0x00007FF67F45A000-memory.dmp

Download

memory/4840-42-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4840-82-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4840-41-0x0000024DE3050000-0x0000024DE3051000-memory.dmp

Download

memory/4840-44-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4840-50-0x00007FF9D5E60000-0x00007FF9D60C3000-memory.dmp

Download

memory/4840-81-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/4840-43-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-92-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-38-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-108-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-37-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-39-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5224-46-0x00007FF9D5E60000-0x00007FF9D60C3000-memory.dmp

Download

memory/5224-36-0x000001965D990000-0x000001965D991000-memory.dmp

Download

memory/5224-48-0x0000000140000000-0x0000000142C0E000-memory.dmp

Download

memory/5240-192-0x00007FF6F13E0000-0x00007FF6F1F9A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads