1b8f6eb916839bb36e680ce6ae206ee4718eb9f599314cfc8d74789ef8df5ad0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:41

Target
2026-07-30_f550da1a62ca56566d948148939da92b_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260730-c6m75abn7x
SHA256 1b8f6eb916839bb36e680ce6ae206ee4718eb9f599314cfc8d74789ef8df5ad0
MD5 f550da1a62ca56566d948148939da92b
SHA1 27ba28b6f99ad8dbaa4d7c0968b668e6d2a46603
SHA512 37a30766b8a5d216d65677f69832f5acf5b71d9f0a82935ec3e3aba3243e4ab495cd286979e94d6022843fa673d3ef1a39afa7e1c8eb13ff4fa4bd94167c4582
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T106A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	javaws.exe
4520	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 4520	5588	2026-07-30_f550da1a62ca56566d948148939da92b_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_f550da1a62ca56566d948148939da92b_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f550da1a62ca56566d948148939da92b_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_f550da1a62ca56566d948148939da92b_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520