330cc2d960625196041609a956a051ec33d8211197b8c8a3e83971f5e068c9d2

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 21:34

Target
2026-07-23_681599850869b70fa7425420cd447923_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260723-1e88aawsbs
SHA256 330cc2d960625196041609a956a051ec33d8211197b8c8a3e83971f5e068c9d2
MD5 681599850869b70fa7425420cd447923
SHA1 0f55ebdc572c88b9a3dcbc0355e18b5952aa400e
SHA512 63f46b71c97982ace42f979b8852ca5a47d066b679a4d731a1e8f9efab4e165e2f168bcc495d1a4b97c1aec5f5fe370cf21bc6827449c87517133c70a38be3a9
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T129A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	javaws.exe
2360	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2360	1188	2026-07-23_681599850869b70fa7425420cd447923_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-23_681599850869b70fa7425420cd447923_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_681599850869b70fa7425420cd447923_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-23_681599850869b70fa7425420cd447923_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360