3d3e082b10c9338dc07a104479dc2626531242ec86334a623f409c894af51ae8

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:16

Target
2026-07-30_810a22104ca6667bd3906794945527ae_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260730-dsfrka11dw
SHA256 3d3e082b10c9338dc07a104479dc2626531242ec86334a623f409c894af51ae8
MD5 810a22104ca6667bd3906794945527ae
SHA1 03ee2aaba1eae27a7bb5238c753bf025166e7840
SHA512 51b271613da2292c547339c11d38ed8b14e99cca4e05f274eea98099b2e837621b041d77a47702c434ff667fec05f47520f236cf6a0b223f2b24d3d75c9ab404
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T1B8A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1780	javaws.exe
1780	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1780	2968	2026-07-30_810a22104ca6667bd3906794945527ae_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_810a22104ca6667bd3906794945527ae_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_810a22104ca6667bd3906794945527ae_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_810a22104ca6667bd3906794945527ae_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780