0839ebc0edf45fc2642e79d09895f39da708b06f7b58d8e32db85e2c4e532683

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 03:12

Target
2026-08-02_b16aae207d1166e12a17edb56e00e8c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 203KB
Sample260803-dp89psbd68
SHA256 0839ebc0edf45fc2642e79d09895f39da708b06f7b58d8e32db85e2c4e532683
MD5 b16aae207d1166e12a17edb56e00e8c3
SHA1 99a88caf250a9e391b0bcad51db3a7fa375518d3
SHA512 89a979091636b7cfecebc66df9b1b4a921b9b4795c2529dc516d99ae13442bf6f854eaf1da85ac38790d492ea3e45bf64ae20c03be071861de35ce2f9dbdb18e
SSDEEP 3072:K5NXd10bRXj83vANP772kV8OsF3ijgC7eT:KHd10tT8/yKkVn1i
TLSH
T18514D243B6DC3CE6D0368274A77787C0C76EFC215150CA2E16D4625A9E7E283BD26BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	2026-08-02_b16aae207d1166e12a17edb56e00e8c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4508	2026-08-02_b16aae207d1166e12a17edb56e00e8c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_b16aae207d1166e12a17edb56e00e8c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b16aae207d1166e12a17edb56e00e8c3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact