69a771618e9607e611af61ec92c2b73c39e34a383410f3990e8a175432f6ee5e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7c4d94bce3e552783f4a9fddd0ea4d02_cobalt-strike_icedid.exe
Size 249KB
Sample260809-23tyyaer4t
SHA256 69a771618e9607e611af61ec92c2b73c39e34a383410f3990e8a175432f6ee5e
MD5 7c4d94bce3e552783f4a9fddd0ea4d02
SHA1 f8a2f204e99a17dc7ef1f6f26ecf2aac616947d0
SHA512 cbef527d8abb8e8301a50ca7ee6550a1d77bef07772256aba223785efce8b32e2003ed7ca3d6bf1279fefa57a562c8214a84ace6b994e5f601766547f0dd6a62
SSDEEP 6144:vyQ2RdPzCj8MP7ekVOi6LRvX4eBYjw7UyXUe+:vypnuj8MP7ekkxLhX4eglyz+
TLSH
T1BE447C1BF1A078E5D2A77E3C8C41B5459772B8F93F305FEF629821496E226F11D29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1104	qgrmr.exe
3020	qgrmr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4796	schtasks.exe
3496	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 1104	4160	2026-08-09_7c4d94bce3e552783f4a9fddd0ea4d02_cobalt-strike_icedid.exe	89
PID 1104 wrote to memory of 2256	1104	qgrmr.exe	90
PID 1104 wrote to memory of 4796	1104	qgrmr.exe	92
PID 3020 wrote to memory of 984	3020	qgrmr.exe	96
PID 3020 wrote to memory of 5484	3020	qgrmr.exe	98
PID 3020 wrote to memory of 3496	3020	qgrmr.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7c4d94bce3e552783f4a9fddd0ea4d02_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7c4d94bce3e552783f4a9fddd0ea4d02_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Public\u2zzqgyr\qgrmr.exe
  "C:\Users\Public\u2zzqgyr\qgrmr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc"
    3⤵
    PID:2256
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /create /tn "WindowsUpdateSvc" /tr "\"C:\Users\Public\u2zzqgyr\qgrmr.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796

C:\Users\Public\u2zzqgyr\qgrmr.exe
"C:\Users\Public\u2zzqgyr\qgrmr.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc"
  2⤵
  PID:984
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc1"
  2⤵
  PID:5484
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /create /tn "WindowsUpdateSvc1" /tr "\"C:\Users\Public\u2zzqgyr\qgrmr.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jdnmwtu.wpp

Path C:\Users\Public\u2zzqgyr\jdnmwtu.wpp
Size 8KB
SHA256 fc485889f5761348717401c96dd5f9ba229a65c3a39017bd9e0e33dc7affc1e2
MD5 2b850c656107f9cff05dcc5925722cc5
SHA1 fc3389d4738f780b9c363f98de6e19d77dcb4d28
SHA512 9455b69f253906ce5459156aa4d6b04c354e9ff23e57e5f42263df04d10e6fb91f8435c1750a0649c1912b8e4328257c19ae3c2f25254b541f965abb2508128e
SSDEEP 192:g0Mr5oCa4alzeqwJX+YiK+LZqP1MTIAm34K61kkiUS8vdiXub59:s58hKXF7+LZCKTi4K+ViUcXYr
TLSH
T1D102AF305642363EB995D7313CC013F666311E9EB78BF2DA478DA382900C57A0590FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgrmr.exe

Path C:\Users\Public\u2zzqgyr\qgrmr.exe
Size 117KB
SHA256 bc5df2ea06d291d962ce070e4bdbec3724b5cbc0c268aa7da5bb41ccc5f99cdd
MD5 dfa9787b6f002786232cd58edf1c2206
SHA1 4cc9724df7d5f0b915d5c410114e925d2a056a03
SHA512 3ae448156c935f73b44e0510cb1d5149917d14ba760c5eb649279b737b7dd4384517aa6f3fe21f287e0a18b76b98766ab48177a45b738a7c2168de6137a81a89
SSDEEP 1536:1FVVKXZg3Bc8NE1jFYFYdLDQCTH1Sr7eUsX28ZwWdsW+kymdd9dlVm/6/xY/:1FVvwvYELDZVsyUsXzZBekyMN2/oxY/
TLSH
T111C35A57B2B530E8E1B7863485694A55D732BC315B609BEF13A436962F332E09C3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads