a834db3bd27dace9a0aa5995a14e5cf6414dc2362f7dd2d8721d9eca0d688ecb

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 06:05

Target
2026-08-02_679dd04ef9b530178c243ada41f0c59a_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260802-gtjrdswcpg
SHA256 a834db3bd27dace9a0aa5995a14e5cf6414dc2362f7dd2d8721d9eca0d688ecb
MD5 679dd04ef9b530178c243ada41f0c59a
SHA1 93d106334b765a34cc46284523ec10734473cd66
SHA512 1f002b8c2b79e40a68559c86689306f76dc645a1b1c513f726d7c86113843cc16e2ab814cdc7fd485a5a6b2cf4ebe9576e7170353a11a2b55692d3025ba131bf
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T125A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	javaws.exe
4324	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 4324	2256	2026-08-02_679dd04ef9b530178c243ada41f0c59a_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-02_679dd04ef9b530178c243ada41f0c59a_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_679dd04ef9b530178c243ada41f0c59a_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-02_679dd04ef9b530178c243ada41f0c59a_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324