daed5092a7820efbc99024dc7caa5d5199db2333b5791c9500f6eca00778b87f

General

Target
2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
Size 3.6MB
Sample260731-c716dasbrf
SHA256 daed5092a7820efbc99024dc7caa5d5199db2333b5791c9500f6eca00778b87f
MD5 a3eba7c4b40eb37574191b9ea90634d1
SHA1 31dbbe596505528a6028d98ab5abf0c0a22e1479
SHA512 bf3b5dedce96ddc99e53585639af977fa218a5a669ff66287a685641d4a0dc94fb3ca80f43e1c37fc1fbbe7c0773d4e2ca014194293a234d5290ac18faf2a9b7
SSDEEP 49152:aWGfi7UpHn+XBttX3As2cUEfeDWmPKVtBX8mvcXd/5mJKlvDlpiGgSmVJJXA:L7VOZJnx5fiSmVL
TLSH
T10906F105A6C512B9C06BC578C28B0A1FE761708B57669EEF06C169423F63FF25F39329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2184	sc.exe
4268	sc.exe
4912	sc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
2888	cmd.exe
5368	cmd.exe
3788	cmd.exe
1812	cmd.exe
4832	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5996	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4832	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	90
PID 4832 wrote to memory of 4268	4832	cmd.exe	91
PID 2664 wrote to memory of 5608	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	92
PID 5608 wrote to memory of 4912	5608	cmd.exe	93
PID 2664 wrote to memory of 2888	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	94
PID 2888 wrote to memory of 2184	2888	cmd.exe	95
PID 2664 wrote to memory of 5368	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	96
PID 5368 wrote to memory of 5996	5368	cmd.exe	97
PID 2664 wrote to memory of 3788	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	99
PID 2664 wrote to memory of 1812	2664	2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop faceit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\sc.exe
    sc stop faceit
    3⤵
    - Launches sc.exe
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgk
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\sc.exe
    sc stop vgk
    3⤵
    - Launches sc.exe
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WdFilter
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM bfsvc.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bfsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1812