199bc264807eea5c175ebf9fa2bcf0455fd7a28e35e6a5f080cbe05d0eca38e2

General

Target
2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
Size 3.6MB
Sample260805-kzeamstdka
SHA256 199bc264807eea5c175ebf9fa2bcf0455fd7a28e35e6a5f080cbe05d0eca38e2
MD5 de6c87499a58bf63452470b958bbc67b
SHA1 08e5b2b3eb811a52ddc1d46fbf97dddc6bdbbf15
SHA512 4ed7a5cb2140eabebb5bdf1198fed436c89165fe7e02aca58726e8f888716814ead2c3d1e4e29a1d86e3706703e6da1a5913a69f4be9b81f7879d753a84cb113
SSDEEP 98304:B7uj6NIB9niQsaAeqcZj4mJm9gQ6VCgO4u:Mjv+wqcutgQR4
TLSH
T16606F111A6C112BDD06BC178C2C70A5BE761708A676A8EEF15C155422FA3FF25F3A32D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3388	sc.exe
4540	sc.exe
3128	sc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
3992	cmd.exe
5032	cmd.exe
2364	cmd.exe
2404	cmd.exe
3636	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3784	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4572	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	86
PID 4572 wrote to memory of 4540	4572	cmd.exe	87
PID 1936 wrote to memory of 3992	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	88
PID 3992 wrote to memory of 3128	3992	cmd.exe	89
PID 1936 wrote to memory of 5032	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	90
PID 5032 wrote to memory of 3388	5032	cmd.exe	91
PID 1936 wrote to memory of 2364	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	92
PID 2364 wrote to memory of 3784	2364	cmd.exe	93
PID 1936 wrote to memory of 2404	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	95
PID 1936 wrote to memory of 3636	1936	2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop faceit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\sc.exe
    sc stop faceit
    3⤵
    - Launches sc.exe
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgk
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\sc.exe
    sc stop vgk
    3⤵
    - Launches sc.exe
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WdFilter
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM bfsvc.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM bfsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3636