e513296f91c4029d4c6800bb499b0fc2ec8b47d8c609344aa7f8cde2dcb64d22

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:50

Target
2026-06-04_5e731aca4ced4b2616e9f87a1325dbea_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 2.1MB
Sample260604-s9166aas4x
SHA256 e513296f91c4029d4c6800bb499b0fc2ec8b47d8c609344aa7f8cde2dcb64d22
MD5 5e731aca4ced4b2616e9f87a1325dbea
SHA1 6750974a348eb26fbb5d69dc1a2e46e8e3359444
SHA512 bee80eb6fbf2b568916b871c1ebef4d8c8da52fc6a37c159912c0a01674acb7a90b2264823702e8bcd5ea6a3c797673986c4cfd81171f70c3481fa2d55ec9e4e
SSDEEP 24576:oeKdY6Lh+zyyw/rzat1+qwu5jcAkSYqyE:oFV+sQwq3pYq
TLSH
T1F9A55B21B2F48E26D0BB957599A18A959D337E610F3096CB22C43E6D3F337C18936763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	2026-06-04_5e731aca4ced4b2616e9f87a1325dbea_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
1228	2026-06-04_5e731aca4ced4b2616e9f87a1325dbea_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-04_5e731aca4ced4b2616e9f87a1325dbea_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5e731aca4ced4b2616e9f87a1325dbea_amadey_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228