7454fc23ebff85469dfebd57f9cfc552383229df9a9283f6bfa4cae8a3e76a85

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe
Size 461KB
Sample260731-qq4rtsterg
SHA256 7454fc23ebff85469dfebd57f9cfc552383229df9a9283f6bfa4cae8a3e76a85
MD5 ebac9f6d6d20bd85a0977d6e74423bd1
SHA1 0ba8220ad28bbf45d806a0f7b28861190048fb7a
SHA512 893bc9d7d6ed925d017be73243e70f3001a16dceddcca2bdc42cc0e2782c4091ce49945f0e7b27d592a9f19202b508821f7338536fce3e9ec0aa8cc6ab5f0480
SSDEEP 6144:5WaRa3wi3N45oN+6quKzFxNJnHy9ETi3w5/vRMQpThteXWn8ixifZPmwSTZ3w0:NRaZT+6MxNJneETi3uXUW8ixkm3w
TLSH
T182A41212F36955C9E1334F359C615B80A73ABD251F906E2F66092B6DEE122C48F32FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88
PID 1324 wrote to memory of 3624	1324	2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ebac9f6d6d20bd85a0977d6e74423bd1_cobalt-strike_icedid_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\dllhost.exe
  "C:\Windows\system32\dllhost.exe"
  2⤵
  PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-0-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1324-17-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3624-1-0x0000000140000000-0x0000000140693000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads