c0f5ae18a956c40e288f8d759c2d12b9a8165cb3e5b64cd789ee8935eb8767c2

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 10:15

Target
2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.3MB
Sample260605-malpjaex2l
SHA256 c0f5ae18a956c40e288f8d759c2d12b9a8165cb3e5b64cd789ee8935eb8767c2
MD5 b56d13a53f8421f5e022e884971739a8
SHA1 65239b8b2b15d24229367489d7d115fbffe02103
SHA512 d6b4725fbdbec7c473067c7ed1e18eb95b5c85f60d7c6b355e7c6ad734c1e9d123c2c52abe9fdcd8d6bef213878988a4365541c854348f8555f32ef53fc6c2b4
SSDEEP 24576:3AixtfnSagEcmd+OFK5jKTgUiQnUTcDQHFmIPv7K:3AEzcmd3FkHhQnU4rIP
TLSH
T13A55BE0AB3A545FDC077917DCAA2970BEA72B805033197EF13E416591FA33F08A7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5328	2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5328	2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 2736	5328	2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_b56d13a53f8421f5e022e884971739a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2736