General
- Target 2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom
- Size 732KB
- Sample261110-d16b7aywdv
- SHA256 0f2110d51a9e3d9e12866ac0ba7b216e050778999c6bc1faaaeebfd356295edc
Score
10/10
Malware Config
Targets
-
- Target 2026-11-09_d44d88db2f9cab3915a6d68c25927f82_cobalt-strike_icedid_ryuk_satacom
- Size 732KB
- SHA256 0f2110d51a9e3d9e12866ac0ba7b216e050778999c6bc1faaaeebfd356295edc
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
- Custom signature
Detects executables referencing virtualization MAC addresses
Downloads MZ/PE file
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Obfuscated Files or Information
1Command Obfuscation
1