5adb9ce2947420b6fdb45ee5d22b031e35dd6eccdaea1f96a71a4847bce20bb5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:25

Target
2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 3.5MB
Sample260522-3efbbaax41
SHA256 5adb9ce2947420b6fdb45ee5d22b031e35dd6eccdaea1f96a71a4847bce20bb5
MD5 111e426eaeea20bc674892297fb8dc97
SHA1 cdd8bc29e3589e68f39a0bb9284596ba69459b68
SHA512 ef2401fb47c24da80d5edd08a80e1d89c3ff3ea15c3dc221d50817d360499e9751e9956670463d95a4c5006711ed2ee9540c73ff3d97140f6d6809425c666563
SSDEEP 49152:t8SLWK6oNbSHLzCvj7gI/Tcc2gahyHWfisA9gfxrbKyNLKSgkn0OsSiyP7eQ:1WmN8Cvj7gI/Tcx49IxrmbSgknHIyT
TLSH
T1D8F50272A1109439F1474A38266F5AE76FF0E32A335ACACF12FC5B579E84CC505B928D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2492	r37hsbfurt5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	r37hsbfurt5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	r37hsbfurt5.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2492	3396	2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\r37hsbfurt5.exe
  "C:\Users\Admin\AppData\Local\Temp\r37hsbfurt5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2492

r37hsbfurt5.exe

Path C:\Users\Admin\AppData\Local\Temp\r37hsbfurt5.exe
Size 3.3MB
SHA256 df106069b669334a3a56fe970ead0c96244069786d8da7292d6fba1ff3e58e65
MD5 c015c181cb452d4c2576121de58e6aa5
SHA1 e8947cda6d608064d3045800a2d12f9a1abe5214
SHA512 b64dac867098ba64e70a6f588b06e33c714860a51332a9f938de075eb3f7508922434628e54d86dfc8d71f8b84cb2bdbb4940eb57ac3000e8c761253cc6a2227
SSDEEP 49152:vYiHf0p9kGZwDzuZqQJjUlbz0eWA3A6BZ+IcKyf1AAwZpDFnQHapl6VErJ5f7Nv7:Z0fjKLMA3A6BZ+IcKBplzfj
TLSH
T1F3F59F43B3E4458DE277A938C6615717E332BC140B21A1DF7F880A9A4E676F08E7B791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download