| File name: | CPU miner.zip |
| Full analysis: | https://app.any.run/tasks/34b86461-1c6a-49eb-a285-67b79bb36267 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | June 21, 2025, 01:48:53 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | AA25D899F942F48CEB5C8670CBEB9B2E |
| SHA1: | 91AFEC7FACE23864502F31898C9410AFE658E633 |
| SHA256: | 2C2C97313386DB86124DDAD7C34D5DE2688104758965FDBE8EC12685130687A0 |
| SSDEEP: | 98304:IWdIxG32LCNHgIMyXqeEoyfF+ZHvR9KBA/Ny8Dpfu7PxIqAQfYmRZmlwI1wOYchq:UtV |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 2076)
COINMINER has been found (auto)
- WinRAR.exe (PID: 2076)
Changes the autorun value in the registry
- cpuminer-x86.exe (PID: 2228)
XRED mutex has been found
- Synaptics.exe (PID: 1200)
- Synaptics.exe (PID: 4768)
- cpuminer-x86.exe (PID: 2228)
XRED has been detected (YARA)
- Synaptics.exe (PID: 1200)
SUSPICIOUS
Executable content was dropped or overwritten
- cpuminer-x86.exe (PID: 2228)
Reads security settings of Internet Explorer
- Synaptics.exe (PID: 1200)
- cpuminer-x86.exe (PID: 2228)
There is functionality for communication over UDP network (YARA)
- Synaptics.exe (PID: 1200)
There is functionality for taking screenshot (YARA)
- Synaptics.exe (PID: 1200)
There is functionality for communication dyndns network (YARA)
- Synaptics.exe (PID: 1200)
INFO
Manual execution by a user
- cpuminer.exe (PID: 3844)
- cpuminer.exe (PID: 4236)
- cpuminer-x64.exe (PID: 1812)
- cpuminer-x86.exe (PID: 2228)
- Synaptics.exe (PID: 4768)
- cpuminer-x64.exe (PID: 2808)
Checks supported languages
- cpuminer.exe (PID: 3844)
- cpuminer-x64.exe (PID: 1812)
- cpuminer-x86.exe (PID: 2228)
- cpuminer.exe (PID: 4236)
- ._cache_cpuminer-x86.exe (PID: 4664)
- Synaptics.exe (PID: 1200)
- Synaptics.exe (PID: 4768)
- cpuminer-x64.exe (PID: 2808)
The sample compiled with english language support
- WinRAR.exe (PID: 2076)
- cpuminer-x86.exe (PID: 2228)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2076)
The sample compiled with turkish language support
- WinRAR.exe (PID: 2076)
- cpuminer-x86.exe (PID: 2228)
Reads the computer name
- cpuminer-x86.exe (PID: 2228)
- Synaptics.exe (PID: 1200)
- Synaptics.exe (PID: 4768)
Launching a file from a Registry key
- cpuminer-x86.exe (PID: 2228)
Creates files in the program directory
- cpuminer-x86.exe (PID: 2228)
- Synaptics.exe (PID: 1200)
Checks proxy server information
- Synaptics.exe (PID: 1200)
Compiled with Borland Delphi (YARA)
- Synaptics.exe (PID: 1200)
- slui.exe (PID: 4012)
Process checks computer location settings
- cpuminer-x86.exe (PID: 2228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:06:20 22:24:38 |
| ZipCRC: | 0x391a8b0a |
| ZipCompressedSize: | 1001450 |
| ZipUncompressedSize: | 3134464 |
| ZipFileName: | cpuminer.exe |
Total processes
153
Monitored processes
16
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1200 | "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate | C:\ProgramData\Synaptics\Synaptics.exe | cpuminer-x86.exe | ||||||||||||
User: admin Company: Synaptics Integrity Level: HIGH Description: Synaptics Pointing Device Driver Version: 1.0.0.4 Modules
| |||||||||||||||
| 1812 | "C:\Users\admin\Desktop\cpuminer-x64.exe" | C:\Users\admin\Desktop\cpuminer-x64.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Version: 1.3 Modules
| |||||||||||||||
| 1880 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cpuminer-x64.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1944 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ._cache_cpuminer-x86.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2076 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\CPU miner.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2228 | "C:\Users\admin\Desktop\cpuminer-x86.exe" | C:\Users\admin\Desktop\cpuminer-x86.exe | explorer.exe | ||||||||||||
User: admin Company: Synaptics Integrity Level: HIGH Description: Synaptics Pointing Device Driver Exit code: 0 Version: 1.0.0.4 Modules
| |||||||||||||||
| 2808 | "C:\Users\admin\Desktop\cpuminer-x64.exe" | C:\Users\admin\Desktop\cpuminer-x64.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 1 Version: 1.3 Modules
| |||||||||||||||
| 3844 | "C:\Users\admin\Desktop\cpuminer.exe" | C:\Users\admin\Desktop\cpuminer.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Version: 1.2 Modules
| |||||||||||||||
| 4012 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 450
Read events
3 430
Write events
20
Delete events
0
Modification events
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\CPU miner.zip | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
| (PID) Process: | (2076) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
Executable files
7
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2228 | cpuminer-x86.exe | C:\ProgramData\Synaptics\Synaptics.exe | executable | |
MD5:3F691EA3597F6E5C36B451713D50AA60 | SHA256:8DA82A2441CF2ABA490DC1FBF79E4FB2143D54596D34F92A76CFC7DC50DBAE39 | |||
| 2228 | cpuminer-x86.exe | C:\ProgramData\Synaptics\RCXC90C.tmp | executable | |
MD5:E7F1DA7F0EB1F9B23575087896C40274 | SHA256:FC28B0BEFB3161DAC55D927D86D965C369E4D4F9EE5EB6F95582CDA10718B2FD | |||
| 2076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2076.36223\cpuminer-x64.exe | executable | |
MD5:485D21053BCF2FDD7DFDF609121C046D | SHA256:3E08BA9C617049460441288C0D43E92065E9D8783AD7C47E63E7389061D0D50D | |||
| 2228 | cpuminer-x86.exe | C:\Users\admin\Desktop\._cache_cpuminer-x86.exe | executable | |
MD5:3400F2D7CC9AD0DFA3DB6A3E2C422BA4 | SHA256:6E60B66A37E7EFE0DED2E3BFB06EE258D9C0B5AA730D8DE055AEC52196369294 | |||
| 2076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2076.36223\cpuminer-x86.exe | executable | |
MD5:3F691EA3597F6E5C36B451713D50AA60 | SHA256:8DA82A2441CF2ABA490DC1FBF79E4FB2143D54596D34F92A76CFC7DC50DBAE39 | |||
| 2076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2076.36223\cpuminer.exe | executable | |
MD5:6ED9442536C98550328A1602A3504034 | SHA256:A462535352A73FBEF581E21F54C3E5315003673918B71293E1C20457F9C77E47 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
16
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2520 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1216 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1200 | Synaptics.exe | GET | 200 | 69.42.215.252:80 | http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 | unknown | — | — | whitelisted |
1216 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1200 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2336 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2520 | svchost.exe | 20.190.160.20:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2520 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com |