xmrig | 23ea71a6b905235dc46d41944075ab2c4fcfdceaf74fb685746f10caab9125a0

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 26.1MB
Sample261022-cheabahs6x
SHA256 23ea71a6b905235dc46d41944075ab2c4fcfdceaf74fb685746f10caab9125a0
MD5 d4668d71b5d690796d7ccc3dbe68364a
SHA1 0aef1df384a45cac6c2b356eb4b7d1e1d2a53a5e
SHA512 074f23ea855da0261d76b46b98b264e26680d3df8153b41b10165ae81b02381ff1ecac87a9e71859f495903241ce7ccf96b20fb3c80234c554837ed80fc3043b
SSDEEP 393216:9IiV03gW87c/mYfZd8+RbJ2xzFhXlKBBY721bUxcpTQ:qucDOGRszIBE21biyE
TLSH
T11557A051B30B05F6FF434C3645F96B2F7B39E2DC89B4C55AE428342ABAA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/2944-32-0x0000000142000000-0x0000000142A30000-memory.dmp	xmrig
behavioral1/memory/2944-74-0x0000000142000000-0x0000000142A30000-memory.dmp	xmrig

Executes dropped EXE 3 IoCs

pid	Process
1308	GoogleBrowserSync.exe
2944	GoogleSyncTask.exe
720	GoogleSyncMonitor.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdateBroker64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\aznx8u7eoh\\GoogleBrowserSync.exe\" /user"	file.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GoogleSyncTask.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GoogleSyncTask.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3348	file.exe
3348	file.exe
3348	file.exe
3348	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2944	GoogleSyncTask.exe
Token: SeLockMemoryPrivilege	2944	GoogleSyncTask.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2944	3348	file.exe	97
PID 3348 wrote to memory of 720	3348	file.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleSyncTask.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleSyncTask.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleSyncMonitor.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleSyncMonitor.exe" /watchu
  2⤵
  - Executes dropped EXE
  PID:720

C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleBrowserSync.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleBrowserSync.exe" /user
1⤵
- Executes dropped EXE
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleSyncMonitor.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\GoogleSyncMonitor.exe
Size 26.1MB
SHA256 23ea71a6b905235dc46d41944075ab2c4fcfdceaf74fb685746f10caab9125a0
MD5 d4668d71b5d690796d7ccc3dbe68364a
SHA1 0aef1df384a45cac6c2b356eb4b7d1e1d2a53a5e
SHA512 074f23ea855da0261d76b46b98b264e26680d3df8153b41b10165ae81b02381ff1ecac87a9e71859f495903241ce7ccf96b20fb3c80234c554837ed80fc3043b
SSDEEP 393216:9IiV03gW87c/mYfZd8+RbJ2xzFhXlKBBY721bUxcpTQ:qucDOGRszIBE21biyE
TLSH
T11557A051B30B05F6FF434C3645F96B2F7B39E2DC89B4C55AE428342ABAA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmupdate.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\aznx8u7eoh\chrmupdate.dll
Size 2.2MB
SHA256 6a00235a7d44c3841f50c0cd48cbbc7d0d7781e339fa42b973d7391e5d107b61
MD5 ec5b8be5652693cfa93a60a5f70f15eb
SHA1 1057fea209c63d162f5ac769e955c13919448e5b
SHA512 ebf97fbde055c7e5617ec7f96f979f78db13e8cec978c04088e04208ca993401d9321a9aecead858551662a823227164dc7182e62c87da82ce3353f46d6c66f8
SSDEEP 24576:79QRIJi31XKZYz/NiXpK7LmQievZbAhrVGmvQkOX8FZVfT9F6GVQLgFUAu+AQ:K+a6CgK2SUTYefNS3CAQ
TLSH
T1D3A5D505F71715CFEF9541B06D7DB312EA5DCBA8A188CA779A5C827C3CB2C6E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-12-0x00007FF7DCC50000-0x00007FF7DE621000-memory.dmp

Download

memory/2944-32-0x0000000142000000-0x0000000142A30000-memory.dmp

Download

memory/2944-74-0x0000000142000000-0x0000000142A30000-memory.dmp

Download

memory/2944-91-0x000001B812D90000-0x000001B812DB0000-memory.dmp

Download

memory/3348-2-0x00007FF6FA7C0000-0x00007FF6FC191000-memory.dmp

Download

memory/3348-13-0x00007FF6FA7C0000-0x00007FF6FC191000-memory.dmp

Download

memory/3348-15-0x00007FF6FA7C0000-0x00007FF6FC191000-memory.dmp

Download