cb3bab4143f7d138b360856e13aa93cf519fa8b03749f229d0c3ce00c30d5700

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b415f0a71d70b5e2ef0b4d6046fc4e9a_cobalt-strike_icedid.exe
Size 338KB
Sample260720-c569lscy7m
SHA256 cb3bab4143f7d138b360856e13aa93cf519fa8b03749f229d0c3ce00c30d5700
MD5 b415f0a71d70b5e2ef0b4d6046fc4e9a
SHA1 9d3b0ea67e3bd03d4b27c8a8e62bd2026603c44a
SHA512 6dffa734797055bd4b74bf84a0150a311286ac35b671f53a22ec13d341d9e281979cb605a50056f5961b94454bad98b3e2a17f3997cdace2398dedefadda33d7
SSDEEP 6144:Cv90q7NPirZ9hlcPLYGBDtt1FAFsIqZcR5H:C1wln4xBJ1AFlScXH
TLSH
T117749D87B2A1B3E8F1270F388C4546069BB57E716F975B8F62605A563F7E2C01E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5948	gurfv.exe
4768	gurfv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe
3364	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 5948	4592	2026-07-20_b415f0a71d70b5e2ef0b4d6046fc4e9a_cobalt-strike_icedid.exe	89
PID 5948 wrote to memory of 5792	5948	gurfv.exe	90
PID 4768 wrote to memory of 3364	4768	gurfv.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b415f0a71d70b5e2ef0b4d6046fc4e9a_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b415f0a71d70b5e2ef0b4d6046fc4e9a_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Public\oi01o89ygge\gurfv.exe
  "C:\Users\Public\oi01o89ygge\gurfv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /create /tn "dMoRIOJuAsv" /tr "\"C:\Users\Public\oi01o89ygge\gurfv.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5792

C:\Users\Public\oi01o89ygge\gurfv.exe
"C:\Users\Public\oi01o89ygge\gurfv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /create /tn "IlGBZczUgY" /tr "\"C:\Users\Public\oi01o89ygge\gurfv.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gurfv.exe

Path C:\Users\Public\oi01o89ygge\gurfv.exe
Size 152KB
SHA256 955415f950e1278a041992f6c6494b1d482861a78effb2c871907b21258631b0
MD5 dbe2afc0bc8ec760f800895ef3ef1fc7
SHA1 9975f431f96f064fccd6e07f191116091d3e5088
SHA512 810068bd330906b2ae8bbbedfe907661330ecb81053a56363596132e7a0b57fd62e8be487f795857edba8f273072215aa0cc0d47a6c7a29f218abe7cae0b03f0
SSDEEP 3072:WNe9XyoILcvlan4PoCiYHquM0jcre/bLO2TE9P/5jv:thIn4P/DHLv/bi2TEpd
TLSH
T137E36C97A3A570F9E0768674C4521966D773BC7207209BBF0364B6AA2F373D04C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntktjobjn.mj

Path C:\Users\Public\oi01o89ygge\ntktjobjn.mj
Size 6KB
SHA256 ea3504881d0d1d4cf02be3a7a35e0513548708eb800e88417d02e9d09e814e22
MD5 0c91f993da3d69da215e5768127a4306
SHA1 710ea915aba52a8e538c9db61262bf8ca133ef48
SHA512 989d9c45a116ef44fdbd3ba9c7165478c4002c96b1f51e4d078935b7de851aaed8a718c56366e0d49e05a02fcceeabd67a26695edefeaf636693874edabe646a
SSDEEP 192:b3hcMqb1eyo5/lpWNLRVO/AdRU7xfJbRBI:Dh6b1eyo5aNLfMAnUNy
TLSH
T142D18D68C7DF39790728512DE6131BDA78191EB2C98FA2F56F720014DC9E98188D0DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads