Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 11:55
General
- Target 2026-11-01_ad9a2d94d6387269c98981c2d188ee38_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe
- Size 51.4MB
- Sample261102-n3fvesht7z
- SHA256 8aadb91165871ad045cedbe25daf2f3a6f33d39054df8b3103a25c318af529e4
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 6 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Detects executables referencing virtualization MAC addresses 8 IoCs
- XMRig Miner payload 21 IoCs
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 4 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_ad9a2d94d6387269c98981c2d188ee38_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ad9a2d94d6387269c98981c2d188ee38_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
- Windows security modification
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e714440064e310b02054032111d1901331015041c6f0702045475505e4943344459580b3136005c2d1703340f2510253c02560629580d5a240d58133d07092f0a14153c1e030424010a1806103234215f34075c1c2f062c2b245f24572a1e571601045a0f745c2b393d3523143f5772570e213815072911180056061d1634034d441e610f020000345059504e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195459744440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e714440064e310b02054032111d1901331015041c6f0702045475505e4943344459580b3136005c2d1703340f2510253c02560629580d5a240d58133d07092f0a14153c1e030424010a1806103234215f34075c1c2f062c2b245f24572a1e571601045a0f745c2b393d3523143f5772570e213815072911180056061d1634034d441e610f020000345059504e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195459744440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
GameUpdater.exe
GameUpdater.exe
GameUpdater.exe
GameUpdater.exe
memory/2032-24-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-2-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-65-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-53-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-0-0x0000014932D80000-0x0000014932D81000-memory.dmp
memory/2032-1-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-60-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-15-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-75-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2032-35-0x00007FF7475E0000-0x00007FF74A94D000-memory.dmp
memory/2196-37-0x00007FFCECC50000-0x00007FFCECC52000-memory.dmp
memory/2196-38-0x00007FF6508C0000-0x00007FF6518C0000-memory.dmp
memory/2220-55-0x00007FFCECC50000-0x00007FFCECC52000-memory.dmp
memory/2220-56-0x00007FF7A5580000-0x00007FF7A6580000-memory.dmp
memory/3308-5-0x000001C114190000-0x000001C1141B0000-memory.dmp
memory/3308-17-0x00007FF65FB50000-0x00007FF660437000-memory.dmp
memory/3308-16-0x00007FF65FB50000-0x00007FF660437000-memory.dmp
memory/4380-77-0x00007FFCECC50000-0x00007FFCECC52000-memory.dmp
memory/4380-78-0x00007FF6DF4B0000-0x00007FF6E04B0000-memory.dmp
memory/4988-18-0x00007FFCECC50000-0x00007FFCECC52000-memory.dmp
memory/4988-19-0x00007FF7623E0000-0x00007FF7633E0000-memory.dmp
memory/5712-61-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-63-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-54-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-44-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-74-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-36-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-76-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-26-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-83-0x00007FF701E40000-0x00007FF702727000-memory.dmp
memory/5712-85-0x00007FF701E40000-0x00007FF702727000-memory.dmp