Serviceamd10 launcher drops and starts a separate XMRig executable
Two sandbox reports show the submitted file deploying a distinct XMRig executable, a configuration file and a WinRing0 driver, then starting the executable. A sample-associated event records the exact driver loading, but the evidence does not show how it was used or whether mining work was completed.
A Windows executable placed three files in C:\Windows\Serviceamd10\: another executable, a configuration file and a WinRing0 driver. Sandbox process trees recorded the new executable running as its child. The important question is not simply whether “Serviceamd10” is a miner, but what the original file puts into operation—and whether the accompanying driver remains on disk or is actually loaded. The records examined by CTX Threat Intelligence support a concrete answer.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read