e4d1269d258bfd71122ff366131e8aa50a1e26a28ccdf5d9509cb6048296629e

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 23:50

Target
2026-06-04_94780c824aa95d0516277135ec150ece_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe
Size 2.0MB
Sample260604-3vrpaagy7v
SHA256 e4d1269d258bfd71122ff366131e8aa50a1e26a28ccdf5d9509cb6048296629e
MD5 94780c824aa95d0516277135ec150ece
SHA1 d0337485d40ffab7108fe7872b9e4b3c5060cc20
SHA512 ea667a3cf43ae0e6277e27854a2678983dbd6278ba5df0feef02c0b6baf9fbe1e49a2d24a1b8410fa204e242f9bdeba99d045a00da7c8285485e5b6996208fd7
SSDEEP 24576:oeKdYe5jcAkSYqyEYExqatgl8bfYTqMi8CtBd2QHCHmTBW5xrCn5KE+9xYcLP:ojpYqXqatglpqJtb2I0C5KYcLP
TLSH
T1B0A51715B7A88B65E077C179C8E29696EE323C415F3087CF1245AB6C3E336D1D93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5152	2026-06-04_94780c824aa95d0516277135ec150ece_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe
5152	2026-06-04_94780c824aa95d0516277135ec150ece_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-04_94780c824aa95d0516277135ec150ece_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_94780c824aa95d0516277135ec150ece_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5152