91745f012cb29fb94f1aebf0d0c4751fb7a6fc6dfe3290c078eb3ac89fc40e1f

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:05

Target
2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 204KB
Sample260804-k2h2lsge96
SHA256 91745f012cb29fb94f1aebf0d0c4751fb7a6fc6dfe3290c078eb3ac89fc40e1f
MD5 ecb17d7b232e08366248c338646c6595
SHA1 9befce8e8c14b7010fbf3b9293c7da977e05f8dd
SHA512 0775d2981fa405bd6507d1617a5f523ac7f6d9c157a2921457708fabd6876934b59ad9d003c23f7009f9676fecd873bee340c20e6863c5dd88bc583e13d6f7f7
SSDEEP 3072:hJ81+hCv1DjkN5Q30bF2r9S6DTleT16nd/dkExO4QXnm+ZCoKGs8:axVTls89K7PEofs8
TLSH
T10C146B4AB6A604F5D5B7C138C892661AF67234550730DBEB47A04B7AAF237D0DC7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5924	2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe
5924	2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe
5924	2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe
5924	2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5924