Overview

overview

10

Static

static

1

2026-07-26...ar.exe

windows10-2004-x64

10

2026-07-26...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    164s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/07/2026, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-26_7e35ec7c6362babd22ec44b8684f20be_cobalt-strike_icedid_njrat_remcos_satacom_vidar.exe
  • Size 5.3MB
  • Sample260726-3eckessyat
  • SHA256 8786f9edbb6f7344ebbbb5814870d35da4c680611750076a6d547e7205e7c174
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-26_7e35ec7c6362babd22ec44b8684f20be_cobalt-strike_icedid_njrat_remcos_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-26_7e35ec7c6362babd22ec44b8684f20be_cobalt-strike_icedid_njrat_remcos_satacom_vidar.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\AppData\Local\Temp\PackFramework64.exe
        "C:\Users\Admin\AppData\Local\Temp\PackFramework64.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT /ZIP_SOURCE="C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1580

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Framework_License_EN.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\Framework_License_EN.pdf
        • Size 76KB
        • SHA256 095ce5d1d2ad94bd6ab9423e9bcb537d607f0d795fc827408d5afac93470ecf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PackFramework64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\PackFramework64.exe
        • Size 1.7MB
        • SHA256 25b15b080ca7560530357ecff7b68e954e17d20bbb50804b017d2ac0a5f88d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Param.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Param.ini
        • Size 34B
        • SHA256 059c7231d96505df8b9d525da6bdee45fbabfd45b28d0062c23da6ca43309e9e
        • MD5 SHA1 SHA512
        Submit Download

        wd300mat64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300mat64.dll
        • Size 378KB
        • SHA256 89d5944dffadcdbb9a5b1f452f874def8ab693625d7ab515b65057f711ba6405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300mdl64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300mdl64.dll
        • Size 4.9MB
        • SHA256 42022d3fa9ed93af8e0529f4148d47b392d8a3a7eb7b6ce902f62a4449aa8cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300obj64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300obj64.dll
        • Size 24.7MB
        • SHA256 e661f6b850a566d1cfd3e4397d9c09ebadf618acc5a772b9169c9ca1dccdad8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300pdf64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300pdf64.dll
        • Size 6.2MB
        • SHA256 4ba52f151bec9265c1a73070a65055d6c1211e3859d4c8a14e814a6d4362b35c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300pnt64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300pnt64.dll
        • Size 2.7MB
        • SHA256 b86e97dedb2c92001499b866550ce58e9b7e58fcb651901fc978d0eaee086692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300std64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300std64.dll
        • Size 3.8MB
        • SHA256 436faef95f65200a90d89863d17a40a76a80497b367da0cfead8485f8ed45287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300vm64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300vm64.dll
        • Size 6.3MB
        • SHA256 664482f8f37ae2d33f1f9c71fa861d5cf148ebfde484b19edef05b406ef30591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wd300xml64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\wd300xml64.dll
        • Size 2.5MB
        • SHA256 0594d4f5a1489e2d3cf169d1c00115742819c0f332b71d263efa6b5e746a772a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download