Analysis
- max time kernel
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
- Size 37.4MB
- Sample260718-nsfrnsdv2s
- SHA256 1890d6f7d1b4aba0f420a7030355678a607400a4a1d451b4dd5c24d361c851fa
- MD5 2c95922152ebfa0c013e6c37d0c5264b
- SHA1 3ec2f24a21651b658508bb9b46c055bafe6a178e
- SHA512 33a89ddbbad7d7b3db9a95ea34830d1434f4841814caeaa4292600a387411ad18f0bafd9b25e6f1537a66cc32285b4e3f19833ff7b4f9c5c5385f012b0442ef3
- SSDEEP 786432:hw6usKrkf+0vXC+Zf6oxP6zlFfLLJ3zYVhTH8tiwLe4qpfJjo5K1B:Rf+0vXTZf6SizlFTd3z8hD1wLe4qZJco
- TLSH T179873309F7D109A2F4E5FE31CB47C806F7783D46617196592BA88A3F2F3A2548C76326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SingleInstance.exe.lnk 2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe - Executes dropped EXE 1 IoCs
pid Process 2144 SingleInstance.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SingleInstance.ini SingleInstance.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SingleInstance.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe 2144 SingleInstance.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2144 SingleInstance.exe 2144 SingleInstance.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2144 SingleInstance.exe 2144 SingleInstance.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 424 2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe 424 2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2c95922152ebfa0c013e6c37d0c5264b_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:424
-
C:\SISTEM~1\MEG\SingleInstance.exeC:\SISTEM~1\MEG\SINGLE~1.EXE1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SISTEMASMEG\MEG\SingleInstance.exe
- Size 421KB
- SHA256 8d5ffdc6776f21fd55b1fba91d970b65068d0001bc159f88f28907c9e5e791a1
- MD5 3f4155d132e40c1b3686cbe0bfd03905
- SHA1 417c8aa9b1138ec0dedd7ab1077a555d1d7b002e
- SHA512 403e1c0d2eac3ac007e5636736670c9b958e9885c0f40494c09f95f3bbf4fc0343fd50537fc388198f11f7c1ed757610247da92d913b514190504dadf2ef1e08
- SSDEEP 12288:wNIQAPGsAqY9IMVYd38sJdpQHlGlY8KfTS/Q:5PGSY91VwNJcFMqTsQ
- TLSH T1C794BE16349188F3CC4284B10AAAAF70BBF6DE30083419D3EBD5ED997E695D19B1E317
- MD5 SHA1 SHA512 SSDEEP TLSH