Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 12:55
General
- Target Mina.jar
- Size 26KB
- Sample261020-p52eksbf75
- SHA256 b4a2106375c183c4c88d831e5e836096958458c0a2c8831ed5f6d61ffb9b3790
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Mina.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Mina\xmrig' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_clcgksak.lhr.ps1
xmrig.exe
memory/116-141-0x000001B19C040000-0x000001B19C050000-memory.dmp
memory/116-150-0x000001B19C080000-0x000001B19C0A2000-memory.dmp
memory/4368-2-0x0000021B476C0000-0x0000021B47930000-memory.dmp
memory/4368-14-0x0000021B47930000-0x0000021B47940000-memory.dmp
memory/4368-16-0x0000021B47950000-0x0000021B47960000-memory.dmp
memory/4368-15-0x0000021B47940000-0x0000021B47950000-memory.dmp
memory/4368-18-0x0000021B47960000-0x0000021B47970000-memory.dmp
memory/4368-20-0x0000021B47970000-0x0000021B47980000-memory.dmp
memory/4368-24-0x0000021B47980000-0x0000021B47990000-memory.dmp
memory/4368-26-0x0000021B47990000-0x0000021B479A0000-memory.dmp
memory/4368-27-0x0000021B479A0000-0x0000021B479B0000-memory.dmp
memory/4368-22-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-29-0x0000021B479B0000-0x0000021B479C0000-memory.dmp
memory/4368-31-0x0000021B476C0000-0x0000021B47930000-memory.dmp
memory/4368-32-0x0000021B479C0000-0x0000021B479D0000-memory.dmp
memory/4368-34-0x0000021B479D0000-0x0000021B479E0000-memory.dmp
memory/4368-39-0x0000021B479E0000-0x0000021B479F0000-memory.dmp
memory/4368-38-0x0000021B47950000-0x0000021B47960000-memory.dmp
memory/4368-37-0x0000021B47940000-0x0000021B47950000-memory.dmp
memory/4368-36-0x0000021B47930000-0x0000021B47940000-memory.dmp
memory/4368-41-0x0000021B479F0000-0x0000021B47A00000-memory.dmp
memory/4368-43-0x0000021B47960000-0x0000021B47970000-memory.dmp
memory/4368-44-0x0000021B47A00000-0x0000021B47A10000-memory.dmp
memory/4368-46-0x0000021B47970000-0x0000021B47980000-memory.dmp
memory/4368-51-0x0000021B47A20000-0x0000021B47A30000-memory.dmp
memory/4368-54-0x0000021B47A30000-0x0000021B47A40000-memory.dmp
memory/4368-53-0x0000021B479A0000-0x0000021B479B0000-memory.dmp
memory/4368-52-0x0000021B47990000-0x0000021B479A0000-memory.dmp
memory/4368-56-0x0000021B47A40000-0x0000021B47A50000-memory.dmp
memory/4368-50-0x0000021B47980000-0x0000021B47990000-memory.dmp
memory/4368-49-0x0000021B47A10000-0x0000021B47A20000-memory.dmp
memory/4368-61-0x0000021B47A50000-0x0000021B47A60000-memory.dmp
memory/4368-60-0x0000021B479B0000-0x0000021B479C0000-memory.dmp
memory/4368-66-0x0000021B47A60000-0x0000021B47A70000-memory.dmp
memory/4368-65-0x0000021B479C0000-0x0000021B479D0000-memory.dmp
memory/4368-69-0x0000021B479D0000-0x0000021B479E0000-memory.dmp
memory/4368-70-0x0000021B47A70000-0x0000021B47A80000-memory.dmp
memory/4368-73-0x0000021B479E0000-0x0000021B479F0000-memory.dmp
memory/4368-74-0x0000021B47A80000-0x0000021B47A90000-memory.dmp
memory/4368-75-0x0000021B479F0000-0x0000021B47A00000-memory.dmp
memory/4368-76-0x0000021B47A90000-0x0000021B47AA0000-memory.dmp
memory/4368-78-0x0000021B47A00000-0x0000021B47A10000-memory.dmp
memory/4368-80-0x0000021B47AA0000-0x0000021B47AB0000-memory.dmp
memory/4368-79-0x0000021B47A10000-0x0000021B47A20000-memory.dmp
memory/4368-83-0x0000021B47AB0000-0x0000021B47AC0000-memory.dmp
memory/4368-85-0x0000021B47AC0000-0x0000021B47AD0000-memory.dmp
memory/4368-84-0x0000021B47A20000-0x0000021B47A30000-memory.dmp
memory/4368-89-0x0000021B47AD0000-0x0000021B47AE0000-memory.dmp
memory/4368-88-0x0000021B47A30000-0x0000021B47A40000-memory.dmp
memory/4368-91-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-94-0x0000021B47AE0000-0x0000021B47AF0000-memory.dmp
memory/4368-93-0x0000021B47A40000-0x0000021B47A50000-memory.dmp
memory/4368-98-0x0000021B47AF0000-0x0000021B47B00000-memory.dmp
memory/4368-97-0x0000021B47A50000-0x0000021B47A60000-memory.dmp
memory/4368-100-0x0000021B47A60000-0x0000021B47A70000-memory.dmp
memory/4368-99-0x0000021B47B00000-0x0000021B47B10000-memory.dmp
memory/4368-102-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-104-0x0000021B47A70000-0x0000021B47A80000-memory.dmp
memory/4368-105-0x0000021B47B10000-0x0000021B47B20000-memory.dmp
memory/4368-109-0x0000021B47B20000-0x0000021B47B30000-memory.dmp
memory/4368-108-0x0000021B47A80000-0x0000021B47A90000-memory.dmp
memory/4368-112-0x0000021B47B30000-0x0000021B47B40000-memory.dmp
memory/4368-111-0x0000021B47A90000-0x0000021B47AA0000-memory.dmp
memory/4368-115-0x0000021B47B40000-0x0000021B47B50000-memory.dmp
memory/4368-114-0x0000021B47AA0000-0x0000021B47AB0000-memory.dmp
memory/4368-118-0x0000021B47B50000-0x0000021B47B60000-memory.dmp
memory/4368-117-0x0000021B47AB0000-0x0000021B47AC0000-memory.dmp
memory/4368-131-0x0000021B47B60000-0x0000021B47B70000-memory.dmp
memory/4368-130-0x0000021B47AC0000-0x0000021B47AD0000-memory.dmp
memory/4368-138-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-142-0x0000021B47AE0000-0x0000021B47AF0000-memory.dmp
memory/4368-140-0x0000021B47AD0000-0x0000021B47AE0000-memory.dmp
memory/4368-157-0x0000021B47B00000-0x0000021B47B10000-memory.dmp
memory/4368-156-0x0000021B47AF0000-0x0000021B47B00000-memory.dmp
memory/4368-160-0x0000021B47B70000-0x0000021B47B80000-memory.dmp
memory/4368-162-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-164-0x0000021B47B80000-0x0000021B47B90000-memory.dmp
memory/4368-163-0x0000021B47B10000-0x0000021B47B20000-memory.dmp
memory/4368-167-0x0000021B47B20000-0x0000021B47B30000-memory.dmp
memory/4368-168-0x0000021B47B90000-0x0000021B47BA0000-memory.dmp
memory/4368-170-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-172-0x0000021B47B30000-0x0000021B47B40000-memory.dmp
memory/4368-173-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-174-0x0000021B45DF0000-0x0000021B45DF1000-memory.dmp
memory/4368-175-0x0000021B476C0000-0x0000021B47930000-memory.dmp
memory/4368-176-0x0000021B47930000-0x0000021B47940000-memory.dmp
memory/4368-190-0x0000021B47A30000-0x0000021B47A40000-memory.dmp
memory/4368-189-0x0000021B47A10000-0x0000021B47A20000-memory.dmp
memory/4368-188-0x0000021B47A20000-0x0000021B47A30000-memory.dmp
memory/4368-187-0x0000021B479F0000-0x0000021B47A00000-memory.dmp
memory/4368-186-0x0000021B479E0000-0x0000021B479F0000-memory.dmp
memory/4368-185-0x0000021B479D0000-0x0000021B479E0000-memory.dmp
memory/4368-184-0x0000021B479C0000-0x0000021B479D0000-memory.dmp
memory/4368-183-0x0000021B479B0000-0x0000021B479C0000-memory.dmp
memory/4368-182-0x0000021B479A0000-0x0000021B479B0000-memory.dmp
memory/4368-181-0x0000021B47990000-0x0000021B479A0000-memory.dmp
memory/4368-180-0x0000021B47980000-0x0000021B47990000-memory.dmp
memory/4368-179-0x0000021B47970000-0x0000021B47980000-memory.dmp
memory/4368-178-0x0000021B47960000-0x0000021B47970000-memory.dmp
memory/4368-177-0x0000021B47940000-0x0000021B47950000-memory.dmp
memory/4368-191-0x0000021B47A50000-0x0000021B47A60000-memory.dmp
memory/4368-192-0x0000021B47A60000-0x0000021B47A70000-memory.dmp
memory/4368-193-0x0000021B47A70000-0x0000021B47A80000-memory.dmp
memory/4368-194-0x0000021B47A80000-0x0000021B47A90000-memory.dmp