5e1bc0c513824834b48ccd088bf1b9e112a0c650f930fe042a582f6aab1ab421

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 03:53

Target
2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid.exe
Size 473KB
Sample260701-ef5etsfy2v
SHA256 5e1bc0c513824834b48ccd088bf1b9e112a0c650f930fe042a582f6aab1ab421
MD5 8d5944e69ec9d5578cc17348f5eb97e7
SHA1 d7134364bc57683ada0e4e8c07abe71db61a673b
SHA512 be0b4b93a0f390fa92ce72ddbf72c61e48a266353b9c4d4cf24419f2cedf5c5f1cd2550d06c654d785894fa2dbdd5c3f378aa359b6bacf550194166e6c4145e5
SSDEEP 6144:tTtB4hw0ub3L5wYPbMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmR4k88e:tTtIw0k6YP71Nfhu+1mqTnNFmR48e
TLSH
T1FAA49D86F79269FAEC7A853C89A24B29FB71F4240360C7DF26944196DF133D04E3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1156	Tax_Notice_75054.exe

Loads dropped DLL 1 IoCs

pid	Process
1156	Tax_Notice_75054.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1156	2944	2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_8d5944e69ec9d5578cc17348f5eb97e7_cobalt-strike_coinminer_hijackloader_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\sxs_0e5852bf\Tax_Notice_75054.exe
  "C:\Users\Admin\AppData\Local\Temp\\sxs_0e5852bf\Tax_Notice_75054.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1156

Tax_Notice_75054.exe

Path C:\Users\Admin\AppData\Local\Temp\sxs_0e5852bf\Tax_Notice_75054.exe
Size 287KB
SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
MD5 c9afda4f027fc9510134cffcc4d54da3
SHA1 c5b5fb5f06d1f6cf98afa0df97f57e9bd7b454ed
SHA512 91fc95c20e93059a470c5d6506ce368581679cb7b43216b44a5a1f2e440eee1729523935943226ad488a98cfc7ac7ce5888bae01ed359962feb3eb01e9b8e458
SSDEEP 6144:/bMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmU:/71Nfhu+1mqTnNFmU
TLSH
T15A547D81FB866EFAEC79447C8AF1662AFB70B0180364C35B26989097DF133915D3A3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvml.dll

Path C:\Users\Admin\AppData\Local\Temp\sxs_0e5852bf\nvml.dll
Size 82KB
SHA256 16324d16b588593bff2981f7f905719f8df51378c427d982f176bbb7c95c32e8
MD5 f1079167761e16c192d54ead1f2df0bd
SHA1 e84e2a1a06876222f8858c04628efd9611fbbfee
SHA512 d06d77f1baee0c9184adcb2205ca93c61a9cbbd7a8a92499d3c3320a332deb56a61b918bb392c73748382c64904243c99c44a2f1973d83cb1f6166f3b654b15e
SSDEEP 1536:wYd35Y0uZvJhjhsdgjaE5Mor6KaZwLCXOJGY1rW+bbWdd4kybF/:w4360uZh6KVCCJ1kEJ
TLSH
T1DB835B859751EA67DD00CA3A84270B29FF35F1010B414FEFBD95412C6F92BE84EBBA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download