3280dae0fc2a38430002a3d396c4a78120417ea4ed97ca42e580d01636e6c0e3

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:32

Target
2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260806-2gexwsbn31
SHA256 3280dae0fc2a38430002a3d396c4a78120417ea4ed97ca42e580d01636e6c0e3
MD5 d76f6dfc9bf2ee65c0594e3a749103c5
SHA1 9bd7049659615466ecdc85a6ad73db9b92a8219a
SHA512 dcc2d55095714f4b05e72d32f2c0a2eb0abd50781439ef40608ac102f78c92d0987556e39ba2f4222f4bbb657c90b47adf9296e948f716a1149968ad6a21e367
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T10AA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	javaws.exe
3124	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 3124	6080	2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-06_d76f6dfc9bf2ee65c0594e3a749103c5_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124