Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 22:54
General
- Target 2026-11-06_cf21e17e09da27916aa2ca2895e302a3_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe
- Size 51.4MB
- Sample261107-2vkejasv2m
- SHA256 08da3e01db062125cd581f9d358c7c9b9a77b5f0696889e6b38dc4213c00798b
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 6 IoCs
- Custom signatureDetects executables referencing virtualization MAC addresses 7 IoCs
- XMRig Miner payload 20 IoCs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 4 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_cf21e17e09da27916aa2ca2895e302a3_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_cf21e17e09da27916aa2ca2895e302a3_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_stealc.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
- Windows security modification
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall show rule name="GameUpdaterConnect"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e714440064e310b02054032111d1901331015041c6f0702045475505e4943344459580b3136005c2d1703340f2510253c02560629580d5a240d58133d07092f0a14153c1e030424010a1806103234215f34075c1c2f062c2b245f24572a1e571601045a0f745c2b393d3523143f5772570e213815072911180056061d1634034d441e610f020000345059504e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195459744440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e714440064e310b02054032111d1901331015041c6f0702045475505e4943344459580b3136005c2d1703340f2510253c02560629580d5a240d58133d07092f0a14153c1e030424010a1806103234215f34075c1c2f062c2b245f24572a1e571601045a0f745c2b393d3523143f5772570e213815072911180056061d1634034d441e610f020000345059504e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195459744440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe"C:\Users\Admin\AppData\Local\Temp\SvcCache\GameUpdater.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1ppcthgg1jehts4g94wpv3y4r5lzxmwgvsyqe@wlxjwf28mdaljqvv2y4f@nock=BpHKdidxe1uaT5bYwCiUVmZkwztVhpWjxBiceAQBe2PdNzk7zyaMVoB --pass x --gpu-fan-speed 80 21550 --no-color --gpu-temp-limit 94 --gpu-temp-resume 84 --pearlhash-kernel 2 --multiple-instance2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
GameUpdater.exe
GameUpdater.exe
GameUpdater.exe
memory/2852-5-0x000001ECAD0D0000-0x000001ECAD0F0000-memory.dmp
memory/2852-16-0x00007FF623380000-0x00007FF623C67000-memory.dmp
memory/2852-17-0x00007FF623380000-0x00007FF623C67000-memory.dmp
memory/3112-78-0x00007FF7743D0000-0x00007FF7753D0000-memory.dmp
memory/3112-77-0x00007FFFA8670000-0x00007FFFA8672000-memory.dmp
memory/4344-18-0x00007FFFA8670000-0x00007FFFA8672000-memory.dmp
memory/4344-19-0x00007FF7C2680000-0x00007FF7C3680000-memory.dmp
memory/4480-43-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-58-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-85-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-83-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-76-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-41-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-33-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-45-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-48-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4480-66-0x00007FF691AA0000-0x00007FF692387000-memory.dmp
memory/4820-0-0x00000265EBC10000-0x00000265EBC11000-memory.dmp
memory/4820-57-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-25-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-15-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-75-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-2-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-1-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-82-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/4820-35-0x00007FF6BE6F0000-0x00007FF6C1A5D000-memory.dmp
memory/5440-37-0x00007FF67DBD0000-0x00007FF67EBD0000-memory.dmp
memory/5440-36-0x00007FFFA8670000-0x00007FFFA8672000-memory.dmp
memory/5596-59-0x00007FFFA8670000-0x00007FFFA8672000-memory.dmp
memory/5596-60-0x00007FF72C3B0000-0x00007FF72D3B0000-memory.dmp