Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
07/08/2026, 00:52
General
- Target 2026-08-06_41b79a82da3d675a287a5cfd21503ac4_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
- Size 2.9MB
- Sample260807-a8cs3adc55
- SHA256 7e48f0d08be5aecceb375ffb16678676cd086147dcbf50f9c4e0588fe8efb68e
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_41b79a82da3d675a287a5cfd21503ac4_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_41b79a82da3d675a287a5cfd21503ac4_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig.exexmrig --url pool.hashvault.pro:443 --user 44nkuDevyMkUnE7Lc4kJThfZqW3zyQ62nZxB9Ca6ikxTK7SMYdLmb9eSdp3PcYDwziHMN1xyq3Yq7BNcbGXDCBhWMzEVEBX --pass TEY3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.bat
xmrig.exe
memory/3000-11-0x000001C8BD960000-0x000001C8BD9DC000-memory.dmp
memory/4312-16-0x000001DB4FCF0000-0x000001DB4FD10000-memory.dmp
memory/4312-17-0x000001DB4FD40000-0x000001DB4FD60000-memory.dmp
memory/4312-18-0x000001DB4FD60000-0x000001DB4FD80000-memory.dmp
memory/4312-19-0x000001DB4FD80000-0x000001DB4FDA0000-memory.dmp
memory/4312-20-0x000001DB4FD60000-0x000001DB4FD80000-memory.dmp
memory/4312-21-0x000001DB4FD80000-0x000001DB4FDA0000-memory.dmp