havoc | df99f4680bff09b54cf9126f0d42123e4b5bfc901591134c6f8802263ebb5ca1

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 09:42

Target
2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 253KB
Sample260708-lppt3aez2l
SHA256 df99f4680bff09b54cf9126f0d42123e4b5bfc901591134c6f8802263ebb5ca1
MD5 db0e9cdceb4788e67f98fe8e90b26702
SHA1 11228120cc2cb9b7225eb054a33d0f54fcdc3d8c
SHA512 122fad1242d838bb24e6871378bbc6bad9adf30182ae7b04befd3d3340dd390eb28276d564b88d31d5f4c751a78ff0849d6caba714195bbf60f7405695b13c63
SSDEEP 6144:UNY0J9QPHEBIFo4l2pji6nPOdLjKSaIILigZRYM7Yj+Ggqwkwbn1JH:UN2HEQNlaO+GdLWnIIL5r3s9gnJ7H
TLSH
T12844CF9573A41CF9EE67923DC9911906EA72BC160B60DB6F03A052671F233916E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor havoc

Family: Havoc, HavocC2
Havoc is an open-source backdoor and post-exploitation framework written in C++.
backdoor havoc

Detects Havoc payload 1 IoCs

resource	yara_rule
behavioral2/memory/2572-0-0x00000220F5A70000-0x00000220F5A8A000-memory.dmp	family_havoc

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2572	908	2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 908 wrote to memory of 2572	908	2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe
  2⤵
  PID:2572

memory/2572-0-0x00000220F5A70000-0x00000220F5A8A000-memory.dmp

Download

memory/2572-1-0x00000220F5C30000-0x00000220F5C4D000-memory.dmp

Download

memory/2572-7-0x00000220F5C30000-0x00000220F5C4D000-memory.dmp

Download