5e9532c0fa049330a997e20e5853070a98bff58ae2d8ec6b23055c0f2018f643

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:06

Target
2026-08-09_0410a213e4d4c94e2e9400c67de55d37_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260809-hw5bjsbl6y
SHA256 5e9532c0fa049330a997e20e5853070a98bff58ae2d8ec6b23055c0f2018f643
MD5 0410a213e4d4c94e2e9400c67de55d37
SHA1 a089bf39a9cab3c83fd840d39ce78708e75a0895
SHA512 4e6f0bf8ee551a2a89912ec6f95b09897d7158c5ba38fb0257cd5c70c3cb15b9ff37f6bc82e655529d38167236b14ef230cb670e4d3f183039ba270b533296ae
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T12DA43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
608	javaws.exe
608	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 608	4992	2026-08-09_0410a213e4d4c94e2e9400c67de55d37_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0410a213e4d4c94e2e9400c67de55d37_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0410a213e4d4c94e2e9400c67de55d37_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-09_0410a213e4d4c94e2e9400c67de55d37_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:608