4e2c7d1bd90819f41ea5066c468fcef608f0bdad03946899af330817cd25897e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:59

Target
2026-07-30_016f94c9d6d2c6370ec7f7ad954ec092_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260730-ekdsnssxb1
SHA256 4e2c7d1bd90819f41ea5066c468fcef608f0bdad03946899af330817cd25897e
MD5 016f94c9d6d2c6370ec7f7ad954ec092
SHA1 d2f72d5dc6542a764de5161b043a865116ee7ccd
SHA512 1a1dac163df6b13ff53efcb62ec2e16ec61c81546b642b061c09c2f8b7c467b3967ee30acf1cc5d28d9931870d6b426e8495e0019f566e6bb84bda0f3812392a
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWz:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T16CA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	javaws.exe
4308	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4308	3680	2026-07-30_016f94c9d6d2c6370ec7f7ad954ec092_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-30_016f94c9d6d2c6370ec7f7ad954ec092_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_016f94c9d6d2c6370ec7f7ad954ec092_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_016f94c9d6d2c6370ec7f7ad954ec092_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308