2691826e063c3ff0bdfc3450e4ae1c71ef8a53f93b96503812c5fbf0acb9ea09

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 07:47

Target
2026-05-10_354ac068540921f16f38ecdbc3669b0b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 568KB
Sample260510-jmkffsd14n
SHA256 2691826e063c3ff0bdfc3450e4ae1c71ef8a53f93b96503812c5fbf0acb9ea09
MD5 354ac068540921f16f38ecdbc3669b0b
SHA1 5b88bccdb1a5a3fc6f30408a15f85a55d5ce523b
SHA512 a1141f0f2b628467fa66e9ded68fdcaf8e1ef2b26b156e25186a17df0ca2e5b3e3624b8020ef3ba4d688dfd4e926cec6ce56379173e674546d883537b808b058
SSDEEP 6144:oBwBjoTKcJ3GMpKHbbDe+//M66520U1hKfYohxadvo3/A483+r296Tl:OwBjozJxpKvDN652nIYoevV3+rt
TLSH
T1F1C45A0AF66804FAE0B3D278C9924906F7F27C4A5771FA5F23A446562F332949D3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2104	ox_1778399230218.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 5028	3980	2026-05-10_354ac068540921f16f38ecdbc3669b0b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	79
PID 5028 wrote to memory of 2104	5028	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-10_354ac068540921f16f38ecdbc3669b0b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_354ac068540921f16f38ecdbc3669b0b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1778399230218.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\ox_1778399230218.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1778399230218.exe
    3⤵
    - Executes dropped EXE
    PID:2104

ox_1778399230218.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1778399230218.exe
Size 277KB
SHA256 600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d
MD5 d712be26fe4bbd0ee1fc9156ea74b705
SHA1 0d73d709f61dcd7d58984dd154c50b925049689c
SHA512 cf5fbb98d408768300e56b6ae809af0dfd4366c47e95ee9e40602ed4827b6f6b4b76cda089ba7561d64bf38bdc64025c9f057e92854808f0b5cf790c1e19868e
SSDEEP 3072:cHg0HbTE/QaJkcHVqJr3NPAG0geM4tO/URydJ/28S2sQdJ1:cHgETakcMJrJ3H4cdJ/B/dJ
TLSH
T1CD547369EF48AC5AD4FB98FB78112A3ED0D0543787F079EA84C2097D5A0885F17FAD90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-0-0x0000000140000000-0x000000014008E000-memory.dmp

Download

memory/3980-16-0x0000000002040000-0x000000000212A000-memory.dmp

Download

memory/3980-17-0x0000000004870000-0x000000000487C000-memory.dmp

Download

memory/3980-18-0x0000000140000000-0x000000014008E000-memory.dmp

Download