35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a

General

Target
2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
Size 3.5MB
Sample260706-2mr5eah15p
SHA256 35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a
MD5 0ec9b8f144ac5766afa1e854c4a6714c
SHA1 a56ed4b58b625b0cdd7d911c084f7a74684f205a
SHA512 55d1b3de6caa8ff39643d6e217f79ba37c668702b708cd3d776a28dd6c41a0104ca4e026a0903fd0a67e80875e884534c551fb5cd84acf42bc7053b2dc5531a4
SSDEEP 49152:hUcRqkaITh5CTi8JJzJp5vddF4VloboZUcJhd7FZZYhAM8kDZgSJYGXguEA8bdm+:Xct9JJzz/kPn678cHFTE
TLSH
T15206F11591D411F9C467C278CA8B1A0BF7A2B409732AAEDF02C549422F63FE25F7E359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5636	sc.exe
1148	sc.exe
3928	sc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2044	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 5780	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	87
PID 5780 wrote to memory of 5636	5780	cmd.exe	88
PID 4484 wrote to memory of 2132	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	89
PID 2132 wrote to memory of 1148	2132	cmd.exe	90
PID 4484 wrote to memory of 3824	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	91
PID 3824 wrote to memory of 3928	3824	cmd.exe	92
PID 4484 wrote to memory of 4324	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	93
PID 4324 wrote to memory of 2044	4324	cmd.exe	94
PID 4484 wrote to memory of 1804	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	96
PID 4484 wrote to memory of 2620	4484	2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop faceit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\system32\sc.exe
    sc stop faceit
    3⤵
    - Launches sc.exe
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgk
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\sc.exe
    sc stop vgk
    3⤵
    - Launches sc.exe
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WdFilter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM bfsvc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bfsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2620