315c879cc16de427d88c90e1d38a1be63823a68932cfb8313a850cbbe216dc90

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 02:45

Target
2026-08-01_b980d8a51d5e2289d57e71de136fbac8_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260801-c8phzadj4v
SHA256 315c879cc16de427d88c90e1d38a1be63823a68932cfb8313a850cbbe216dc90
MD5 b980d8a51d5e2289d57e71de136fbac8
SHA1 dadc0d6af8b043f677f55d7b236475dea3485eba
SHA512 370c3a9451883772fd8264262739836365c0acbae0ae72b74d2df6907108c315181472368099d033a57f852c34c6fdf6c22e9d8fce64cbc5c0b8c34045105a11
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T14AA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	javaws.exe
4888	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4888	4316	2026-08-01_b980d8a51d5e2289d57e71de136fbac8_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_b980d8a51d5e2289d57e71de136fbac8_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_b980d8a51d5e2289d57e71de136fbac8_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_b980d8a51d5e2289d57e71de136fbac8_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888