e0a279b06d989855a8c8cbf391f85e34dd7dd7eebc050adc6dcfeee271055c27

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:03

Target
2026-07-18_78065ad29a8a53b7fa13967d4fc81ef4_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260718-m52dgahs5p
SHA256 e0a279b06d989855a8c8cbf391f85e34dd7dd7eebc050adc6dcfeee271055c27
MD5 78065ad29a8a53b7fa13967d4fc81ef4
SHA1 71513be8509164e96154509cb8331d8a05e035d0
SHA512 b1ef01ee201b3707a73a4903ad21fd1d64feb3fe978f5929db9108a15457aa346ddc504d1b8fffb575fe6c1ba68bfa2df9af98671220c661db54e9b8e79df2d0
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T169A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	javaws.exe
4628	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 4628	5280	2026-07-18_78065ad29a8a53b7fa13967d4fc81ef4_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_78065ad29a8a53b7fa13967d4fc81ef4_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_78065ad29a8a53b7fa13967d4fc81ef4_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-18_78065ad29a8a53b7fa13967d4fc81ef4_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628