9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a

Resubmissions

11/11/2026, 01:44

261111-b58xrsds6q10

10/11/2026, 10:21

261110-mdme8s11ay10

11/02/2026, 07:20

260211-h54rdaby9b7

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/02/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 13.4MB
Sample260211-h54rdaby9b
SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
MD5 8e63bf1232e3d401f2c42afeee96d2f6
SHA1 adbac7e3362ae46b7f569eac95753b280b4010a2
SHA512 e8a24f053dc64f9fd8dd44e9b855bf6c13b8328f5ec25d37bd4b12edb09012db8a6c2e897f5ebba745d5ac148a989c5ed771a02ddabd796a3c1f4641aff5c9e2
SSDEEP 393216:Su9bsBMh6x8VINgvaULDrAXYHyLDohkaF:6Mh2gvaUDAXYHyL0hk
TLSH
T19AE6C0A37299ACDAF6956073DD61E037C361FDA48B3B41EB3C582B5DCBA72118E06311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2132	wscl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3024	2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Users\Admin\AppData\Local\Temp\{12391893-C48D-438E-916B-8DDB981F49FA}\wscl.exe
"C:\Users\Admin\AppData\Local\Temp\{12391893-C48D-438E-916B-8DDB981F49FA}\wscl.exe" fRqc9OgKefzSkRR3/ICDACTuh4ddO7mf3xNz+9nbUDfA5fxe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wscl.exe

Path C:\Users\Admin\AppData\Local\Temp\{12391893-C48D-438E-916B-8DDB981F49FA}\wscl.exe
Size 239KB
SHA256 e8ef6d859757883c9fc71bd59dffd52fc8ed16c4358bbe6c4338b47ca4f3ef30
MD5 6893076f88a115f3a3f4340b51cb5012
SHA1 148f02e0b45d5a5f0ca66f94836c391d1a4a6759
SHA512 a5b85054b574e5231f20daaa3d7c25b0d605ada09aa5b0bc606498b0cc013f63a724290f1c2617c6a39bcac93399f8f07be13cbd549be482cf2f35412b2bd74e
SSDEEP 3072:hRW2kqlpSUk/Hgt7a0RzSDFpPgsU+FanChkG/qo8kR4T6r:pLCU0Hgt7VRzSDFBgV+AChkG/qovR
TLSH
T15734E639274600ECC4460175211AB239CEE3F5E0C61A8AA782BB5D5CFB2F7F6452776B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

procorVex.zip

Path C:\Users\Public\procorVex.zip
Size 90KB
SHA256 207bfc57f8c8f70b655c09a0a4f3d184a3279baf25305a681d61d47eb79581b2
MD5 3e91c798920b515291d243e82f364e80
SHA1 b87e84e7b9abb42028685fea4784d8c18076869d
SHA512 b654b4a775891eb8fa2d8ffa6be1b4aa4cb67558d5e7ce09389f8549db40eb09fe44c6b978d68fb340d5d969139ea2650baf3d92468fd0143b5148c71ba9da12
SSDEEP 1536:soqOTqzGI7s7DZ26LHT82E5X99O15GU00FbsrFXSHcVkTpc5JgGj6lTTJHD3zItK:5zMGj7F2Cz8282EWFbsxXwcVkG5WGj6h
TLSH
T15B9312F405AB551215EAEAC057337E6853018673D43F347A82BDB7B6AF22DCC2066B39
MD5 SHA1 SHA512 SSDEEP TLSH