adaptixc2 | 27ae08cfa787f6af587d9c70fa3713af0bd24187a56935e113c45f78b67300e9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:42

Target
2026-06-26_bee550aca018b94a2eab52d330025abc_cobalt-strike_icedid.exe
Size 229KB
Sample260629-pxd93sft2r
SHA256 27ae08cfa787f6af587d9c70fa3713af0bd24187a56935e113c45f78b67300e9
MD5 bee550aca018b94a2eab52d330025abc
SHA1 12a9bfa828c1bc0465e06691407113de889cd8db
SHA512 7c5c09bed1cbd47e33d65dbd17b420d7fd416f78975099e267d3c87ed8da494d1c5b44cfc6af86ca6781590d14e320a1bc21de8cbce743a11fb02c8551cc720b
SSDEEP 6144:SO/mXK944v8YU58mynxOI37deMUdLUAdVW:F/KKXv8YTmG97/BAXW
TLSH
T1AB34AEAB62E932EBF67A8634D21C17058775BC721F246BBF0E1941491E332E05E3AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Attributes

port
443
url_path
/updates/check.php
user_agent
Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
rat trojan backdoor adaptixc2

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 4944	5508	2026-06-26_bee550aca018b94a2eab52d330025abc_cobalt-strike_icedid.exe	90
PID 5508 wrote to memory of 4944	5508	2026-06-26_bee550aca018b94a2eab52d330025abc_cobalt-strike_icedid.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-26_bee550aca018b94a2eab52d330025abc_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_bee550aca018b94a2eab52d330025abc_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:4944

memory/4944-0-0x000002647D350000-0x000002647D36A000-memory.dmp

Download

memory/4944-1-0x000002647D510000-0x000002647D534000-memory.dmp

Download

memory/4944-2-0x000002647D510000-0x000002647D534000-memory.dmp

Download