61095e9a247c044385c12d4534be1bd019201a52661d00b8c5d18f7724f3ee45

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:11

Target
2026-07-30_921bf482d0f80ea1990f468cc33a7111_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260730-dpy4qs1zfy
SHA256 61095e9a247c044385c12d4534be1bd019201a52661d00b8c5d18f7724f3ee45
MD5 921bf482d0f80ea1990f468cc33a7111
SHA1 c8c6b4dd5415056becedd6a85d30adf89f92beae
SHA512 43e2ee94e054a73ab9c0a79a465927b4a822d5d796a97451c69f7c5fd7284b510ca2d83e7a1f3391fd44d06bef7fc3835b2e83b1d21e542618678139ac620c1a
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T13CA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4564	javaws.exe
4564	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4564	4600	2026-07-30_921bf482d0f80ea1990f468cc33a7111_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_921bf482d0f80ea1990f468cc33a7111_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_921bf482d0f80ea1990f468cc33a7111_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_921bf482d0f80ea1990f468cc33a7111_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564