Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 33.1MB
- Sample260808-d3ex1syhpf
- SHA256 9a4405e0c5f5d4d09015ba528c5d633f11578311b08c7eef252d0c0df14f6483
- MD5 5eda16fc4f9bb73a58f510a10040dce0
- SHA1 e339e784f4990f546dd0475c9036977af862705b
- SHA512 ade8c63e64c24bdf7652fc180e76e8a6c7333e661f8d67120db4b9b7cf30c6bda9a4ace4820b5b1e24a2a5de9a9998a61943e07c62fb27fa1e49e0224bff34ce
- SSDEEP 786432:ywHs3SM55XEwIBxuCOTv8OYafKIo4oe0CGdQHtY:ywMiM5BIBQCO04oe0Z
- TLSH T16B77331BF0E01AECE49669FC49525A6AEB36BC1E0321C32E17A296524F573F1143F772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Setup\Set\PECMD.EXE 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\DelNewly.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\DelNewly.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\Newly.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\one.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv\smartctl.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\setup.jpg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\d.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\__tmp_rar_sfx_access_check_240734875 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\DirectX9.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\orderdrv\DrvType.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv\orderdrv.cmd 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\orderdrv\smartctl.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\d.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\one.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\orderdrv\fsutil.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\Kill.bat 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\DelNewly.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\one.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\one.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\PECMD.EXE 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\DelNewly.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv\mountvol.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\f.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\Newly.reg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv\DrvType.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\orderdrv\fsutil.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\setup.jpg 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\f.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\DirectX9.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\orderdrv\mountvol.exe 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\Setup\Set\orderdrv\orderdrv.cmd 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Setup\Set\Kill.bat 2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5eda16fc4f9bb73a58f510a10040dce0_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in Windows directory
PID:4300