Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 03:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe
- Size 109KB
- Sample260602-d7gmeaev2l
- SHA256 aae1e8aafaf8729f8217e12c1881e01c248345c28ffaea0bbff3cbaf28b238db
- MD5 ec6b77cee4bd0bb28f9903878c689abc
- SHA1 ea89512093734a8946573ff6d11b1a3e84c073ef
- SHA512 1f9bde794fc4753b4204a719c7f7e115427b7ae0a16d566cca01f987aa83578ca5019048fffeb3240a69f770b53c6ef8fdc7f83907303832e33839b0d61d13c6
- SSDEEP 1536:Y/CnA5dbOx4O9j0wfOxCfTH2Twwk8pukqSLlxA/irsWT/d79dlhdVxNU:Y/hbSHfOEWEwk8pubolxMitVzHdVxNU
- TLSH T123B35B4763E631E9E1B78678C8A14615EB72B8750B719FEF03A0465A1F272C18D3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4504 2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_ec6b77cee4bd0bb28f9903878c689abc_cobalt-strike_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Ethereal\Assets\Images\redirect.png
- Size 420B
- SHA256 33700861a1f25447543489d0100f301296e4fb95cd80ed8f589d58ba25db49e1
- MD5 876193fbda46a44fe8dd2a77e3435c82
- SHA1 02fe26f03665cda650b63a147d10ed53cf17815f
- SHA512 51d26b5a4c907ece7668abedea9cecf8c028f2fffc4e16a7f36f405fb2d10d9f5b2e8916b0b967ccf4b67ee00a3a3764aca46f1525c2103a4a2f18554dadf97d
- TLSH T11DE0F1C7E5A138FAF83C7E82F1650663F45F0E80B6132E1E8C13DC614A51A7C858967C
- MD5 SHA1 SHA512 TLSH