Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 12:55
General
- Target Mina.jar
- Size 26KB
- Sample261020-p52eksbf75
- SHA256 b4a2106375c183c4c88d831e5e836096958458c0a2c8831ed5f6d61ffb9b3790
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Mina.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Mina\xmrig' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_fm2xubkt.gou.ps1
xmrig.exe
memory/1112-165-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-160-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-182-0x0000020D23820000-0x0000020D2382A000-memory.dmp
memory/1112-180-0x0000020D23660000-0x0000020D23712000-memory.dmp
memory/1112-177-0x0000020D23640000-0x0000020D2365E000-memory.dmp
memory/1112-173-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-167-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-163-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-187-0x0000020D22F90000-0x0000020D22FA0000-memory.dmp
memory/1112-162-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-161-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-184-0x0000020D22F90000-0x0000020D22FA0000-memory.dmp
memory/1112-158-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-157-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-156-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-155-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-153-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-152-0x0000020D23000000-0x0000020D23022000-memory.dmp
memory/1112-189-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-146-0x00007FF9B2E50000-0x00007FF9B37F4000-memory.dmp
memory/1112-145-0x00007FF9B2FDF000-0x00007FF9B2FE0000-memory.dmp
memory/4492-57-0x000002060D750000-0x000002060D760000-memory.dmp
memory/4492-131-0x000002060D7D0000-0x000002060D7E0000-memory.dmp
memory/4492-49-0x000002060D730000-0x000002060D740000-memory.dmp
memory/4492-47-0x000002060D670000-0x000002060D680000-memory.dmp
memory/4492-2-0x000002060D3D0000-0x000002060D640000-memory.dmp
memory/4492-56-0x000002060D6B0000-0x000002060D6C0000-memory.dmp
memory/4492-60-0x000002060D760000-0x000002060D770000-memory.dmp
memory/4492-59-0x000002060D6C0000-0x000002060D6D0000-memory.dmp
memory/4492-65-0x000002060D770000-0x000002060D780000-memory.dmp
memory/4492-64-0x000002060D6D0000-0x000002060D6E0000-memory.dmp
memory/4492-70-0x000002060D6E0000-0x000002060D6F0000-memory.dmp
memory/4492-71-0x000002060D780000-0x000002060D790000-memory.dmp
memory/4492-74-0x000002060D790000-0x000002060D7A0000-memory.dmp
memory/4492-73-0x000002060D6F0000-0x000002060D700000-memory.dmp
memory/4492-77-0x000002060D7A0000-0x000002060D7B0000-memory.dmp
memory/4492-76-0x000002060D700000-0x000002060D710000-memory.dmp
memory/4492-79-0x000002060D710000-0x000002060D720000-memory.dmp
memory/4492-80-0x000002060D7B0000-0x000002060D7C0000-memory.dmp
memory/4492-84-0x000002060D730000-0x000002060D740000-memory.dmp
memory/4492-85-0x000002060D7C0000-0x000002060D7D0000-memory.dmp
memory/4492-83-0x000002060D720000-0x000002060D730000-memory.dmp
memory/4492-86-0x000002060D7D0000-0x000002060D7E0000-memory.dmp
memory/4492-90-0x000002060D7E0000-0x000002060D7F0000-memory.dmp
memory/4492-89-0x000002060D740000-0x000002060D750000-memory.dmp
memory/4492-91-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-94-0x000002060D750000-0x000002060D760000-memory.dmp
memory/4492-95-0x000002060D7F0000-0x000002060D800000-memory.dmp
memory/4492-96-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-99-0x000002060D800000-0x000002060D810000-memory.dmp
memory/4492-98-0x000002060D760000-0x000002060D770000-memory.dmp
memory/4492-102-0x000002060D810000-0x000002060D820000-memory.dmp
memory/4492-101-0x000002060D770000-0x000002060D780000-memory.dmp
memory/4492-105-0x000002060D780000-0x000002060D790000-memory.dmp
memory/4492-106-0x000002060D820000-0x000002060D830000-memory.dmp
memory/4492-109-0x000002060D790000-0x000002060D7A0000-memory.dmp
memory/4492-110-0x000002060D830000-0x000002060D840000-memory.dmp
memory/4492-113-0x000002060D840000-0x000002060D850000-memory.dmp
memory/4492-112-0x000002060D7A0000-0x000002060D7B0000-memory.dmp
memory/4492-119-0x000002060D7C0000-0x000002060D7D0000-memory.dmp
memory/4492-118-0x000002060D860000-0x000002060D870000-memory.dmp
memory/4492-117-0x000002060D850000-0x000002060D860000-memory.dmp
memory/4492-116-0x000002060D7B0000-0x000002060D7C0000-memory.dmp
memory/4492-132-0x000002060D870000-0x000002060D880000-memory.dmp
memory/4492-48-0x000002060D720000-0x000002060D730000-memory.dmp
memory/4492-54-0x000002060D690000-0x000002060D6A0000-memory.dmp
memory/4492-140-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-142-0x000002060D7E0000-0x000002060D7F0000-memory.dmp
memory/4492-143-0x000002060D880000-0x000002060D890000-memory.dmp
memory/4492-55-0x000002060D740000-0x000002060D750000-memory.dmp
memory/4492-144-0x000002060D7F0000-0x000002060D800000-memory.dmp
memory/4492-50-0x000002060D680000-0x000002060D690000-memory.dmp
memory/4492-51-0x000002060D6A0000-0x000002060D6B0000-memory.dmp
memory/4492-42-0x000002060D660000-0x000002060D670000-memory.dmp
memory/4492-43-0x000002060D710000-0x000002060D720000-memory.dmp
memory/4492-39-0x000002060D650000-0x000002060D660000-memory.dmp
memory/4492-40-0x000002060D700000-0x000002060D710000-memory.dmp
memory/4492-36-0x000002060D640000-0x000002060D650000-memory.dmp
memory/4492-37-0x000002060D6F0000-0x000002060D700000-memory.dmp
memory/4492-34-0x000002060D6E0000-0x000002060D6F0000-memory.dmp
memory/4492-32-0x000002060D6D0000-0x000002060D6E0000-memory.dmp
memory/4492-31-0x000002060D3D0000-0x000002060D640000-memory.dmp
memory/4492-164-0x000002060D800000-0x000002060D810000-memory.dmp
memory/4492-29-0x000002060D6C0000-0x000002060D6D0000-memory.dmp
memory/4492-25-0x000002060D690000-0x000002060D6A0000-memory.dmp
memory/4492-26-0x000002060D6A0000-0x000002060D6B0000-memory.dmp
memory/4492-172-0x000002060D810000-0x000002060D820000-memory.dmp
memory/4492-27-0x000002060D6B0000-0x000002060D6C0000-memory.dmp
memory/4492-175-0x000002060D820000-0x000002060D830000-memory.dmp
memory/4492-21-0x000002060D680000-0x000002060D690000-memory.dmp
memory/4492-179-0x000002060D890000-0x000002060D8A0000-memory.dmp
memory/4492-178-0x000002060D830000-0x000002060D840000-memory.dmp
memory/4492-19-0x000002060D670000-0x000002060D680000-memory.dmp
memory/4492-17-0x000002060D660000-0x000002060D670000-memory.dmp
memory/4492-183-0x000002060D840000-0x000002060D850000-memory.dmp
memory/4492-185-0x000002060D850000-0x000002060D860000-memory.dmp
memory/4492-15-0x000002060D650000-0x000002060D660000-memory.dmp
memory/4492-186-0x000002060D860000-0x000002060D870000-memory.dmp
memory/4492-13-0x000002060D640000-0x000002060D650000-memory.dmp
memory/4492-11-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-190-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-192-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-204-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-207-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-209-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-212-0x000002060BC00000-0x000002060BC01000-memory.dmp
memory/4492-221-0x000002060BC00000-0x000002060BC01000-memory.dmp