cc8b058e850e53ca7d860a3d52181f1157007b8f6639a98be6424f380d90708a

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:50

Target
2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 632KB
Sample260712-p3dkqsas3k
SHA256 cc8b058e850e53ca7d860a3d52181f1157007b8f6639a98be6424f380d90708a
MD5 6d98d60fe99a949e3190d61cff55cf13
SHA1 72fbae33178fa0f46154777d65d82cc6dd0561be
SHA512 eb4ee1ffd8bbf60b8e217ebff7fcc0c4756f0eb7da33e2bdc326c54f2c2ad34ae44792e13ba5d5d3d64b1acd76572d6de7b3dbf07906fde99d44a7875cf40e12
SSDEEP 6144:1RC73KwQhMICsEzdGR+xQvVgEBYd0iKQPqv+PSZ++HlyV+WlnJXdbCuSnF683+rz:1cVQ2QEzcR+xQqgmSIslyFlJNmH3+rt
TLSH
T1FBD46B66F3A414F8E5B7D278C9660942E772BC150760DBCF13A0466A2F23BD09E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects executables Discord URL observed in first stage droppers 2 IoCs

resource	yara_rule
behavioral2/memory/3304-0-0x0000000140000000-0x000000014009E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/3304-19-0x0000000140000000-0x000000014009E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Executes dropped EXE 1 IoCs

pid	Process
5676	ox_1783860656768.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3896	3304	2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 3896 wrote to memory of 5676	3896	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1783860656768.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\ox_1783860656768.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1783860656768.exe
    3⤵
    - Executes dropped EXE
    PID:5676

ox_1783860656768.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1783860656768.exe
Size 277KB
SHA256 600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d
MD5 d712be26fe4bbd0ee1fc9156ea74b705
SHA1 0d73d709f61dcd7d58984dd154c50b925049689c
SHA512 cf5fbb98d408768300e56b6ae809af0dfd4366c47e95ee9e40602ed4827b6f6b4b76cda089ba7561d64bf38bdc64025c9f057e92854808f0b5cf790c1e19868e
SSDEEP 3072:cHg0HbTE/QaJkcHVqJr3NPAG0geM4tO/URydJ/28S2sQdJ1:cHgETakcMJrJ3H4cdJ/B/dJ
TLSH
T1CD547369EF48AC5AD4FB98FB78112A3ED0D0543787F079EA84C2097D5A0885F17FAD90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3304-0-0x0000000140000000-0x000000014009E000-memory.dmp

Download

memory/3304-19-0x0000000140000000-0x000000014009E000-memory.dmp

Download