3280dae0fc2a38430002a3d396c4a78120417ea4ed97ca42e580d01636e6c0e3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 22:32

Target
2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260806-2gexwsbn31
SHA256 3280dae0fc2a38430002a3d396c4a78120417ea4ed97ca42e580d01636e6c0e3
MD5 d76f6dfc9bf2ee65c0594e3a749103c5
SHA1 9bd7049659615466ecdc85a6ad73db9b92a8219a
SHA512 dcc2d55095714f4b05e72d32f2c0a2eb0abd50781439ef40608ac102f78c92d0987556e39ba2f4222f4bbb657c90b47adf9296e948f716a1149968ad6a21e367
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T10AA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	javaws.exe
1396	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1396	752	2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396