479515f10d29955dbd75f6dd20e46abb779dc004e4c1577f6bb2f201d8bbc547

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 6.7MB
Sample260810-a7ew2assbz
SHA256 479515f10d29955dbd75f6dd20e46abb779dc004e4c1577f6bb2f201d8bbc547
MD5 9ff8a3eaa0c9dc35fbdf7f305fcfeec6
SHA1 474e277841dd3aabcba6135a5bceb0415f3be310
SHA512 ce4969263d923c21249c0a49158931ed491e852ff7d6739aac8e3cdf324fbdcd944b885aa690e58a1a29fd4848192d77cffb5d645095049f93ff71aafb4541b3
SSDEEP 196608:u+ZZlyjz+aqZmfRj7D3M/APwEh8o1uqO96b:FPraqZmZj7o/CwEyoVPb
TLSH
T10966336132EF4CFCE062D27989939506E6B1381217718ADF86A9466BCF737405E3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4952	JCOMYSGFKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5900	cmd.exe
1288	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5900	cmd.exe
4224	PING.EXE
1288	cmd.exe
5768	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4224	PING.EXE
5768	PING.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4952	4564	2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4564 wrote to memory of 5900	4564	2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 5900 wrote to memory of 4224	5900	cmd.exe	92
PID 4952 wrote to memory of 1288	4952	JCOMYSGFKA.exe	93
PID 1288 wrote to memory of 5768	1288	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\JCOMYSGFKA.exe
  "C:\Users\Admin\AppData\Local\Temp\JCOMYSGFKA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\JCOMYSGFKA.exe"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 6000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\2026-08-10_9ff8a3eaa0c9dc35fbdf7f305fcfeec6_cobalt-strike_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JCOMYSGFKA.exe

Path C:\Users\Admin\AppData\Local\Temp\JCOMYSGFKA.exe
Size 6.7MB
SHA256 798722396e9c851ad867b564cc92b89a7cf15082a029d4d0ae6eccccf83e7d75
MD5 91c5a905aa7a17b8eb8323a0043c560d
SHA1 68025a66145c1f2d43e9cf59bba29df74fe3d096
SHA512 b377f7e59dc2c649fe2a71f39186c2a52e8ee3a938df6c2866fb8a789a6064962d5581b55d80964d2ba2f30c821348b21825ad35d6cccd3dce05f4476c2aab69
SSDEEP 196608:u+8Bz+NEHz5iM+kSWb4Hf6QYU7CdAzD33Jd6kCGu:E+4zNs/6QWqJd6x
TLSH
T11C663384B36918F9E862807DCD524B06F573BC1A67B0EB7F1755025A8F273849F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download