3a304ca41640747c7f25a51d8691b139e518f0156a6fa88b8f088e78998d8cb5

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe
Size 461KB
Sample260804-hrjjaayvbw
SHA256 3a304ca41640747c7f25a51d8691b139e518f0156a6fa88b8f088e78998d8cb5
MD5 68601b50e8a51de23ac777f24f1d9bb7
SHA1 58aca9e1aaddc3bb382f416a829c2745a9b12315
SHA512 59c3ebc221df2c4949be49398dff9e0f1cdd52b280e69cd6542dce7764dced24b9daab62428422f5eafa0d28a6a6fad4a92fc5612363c7403390a53107f67ce1
SSDEEP 12288:XBHdO4gacKCkc7kMpiuT9WuYGo4P4m9fW:X24zPxI9TY/4PT
TLSH
T1F7A41211FAA914D9F177A83988740A80B63ABD100F558D7B725E2AACEFA51C5CF7DC30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89
PID 1316 wrote to memory of 4548	1316	2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_68601b50e8a51de23ac777f24f1d9bb7_cobalt-strike_icedid_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\dllhost.exe
  "C:\Windows\system32\dllhost.exe"
  2⤵
  PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-0-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1316-17-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4548-1-0x0000000140000000-0x00000001406B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads