General
- Target 2026-11-11_1a78b74ddece44030dd5365709dbab9c_icedid_njrat_ryuk
- Size 2.4MB
- Sample261113-t2seqadx9k
- SHA256 9cbd2ecc9e75e06423a41164bbfc14160388b90d2440b1cbccf137163bdb624d
Malware Config
Targets
-
- Target 2026-11-11_1a78b74ddece44030dd5365709dbab9c_icedid_njrat_ryuk
- Size 2.4MB
- SHA256 9cbd2ecc9e75e06423a41164bbfc14160388b90d2440b1cbccf137163bdb624d
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Downloads MZ/PE file
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1