981f916c0b06de44293961f3dcb659711a3e8d1b0e85998600e4aae5e3457360

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 6.7MB
Sample260810-dm4lfadg73
SHA256 981f916c0b06de44293961f3dcb659711a3e8d1b0e85998600e4aae5e3457360
MD5 01f5a63eb445549b2584007c7bd2fc5e
SHA1 d5ec944d0525c00cf9d1492dc082a1ac9065266e
SHA512 4838558b46f8fbbb4e13af6da68bfa89e3415fcffe82ae921cc69387f39285611066d3bb7d8af7e8214fc929231e627d8383fe7603b86f5f07b03aabd6011bf5
SSDEEP 98304:u0k2PA4g+iYLR+nZfufLQHkkkmhIiHjsiOA8bvGAAPm3j++x2YYPEZmWi5i5VEIT:ub2M6Ul2QHqmhIiDxWfzME4lcEIFm7M5
TLSH
T12C6633ABBA560CFDFC23017A81468614E26178496F76C3BF46A49399EF233D49D3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5428	DKUVGZZSEP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3596	cmd.exe
1600	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3596	cmd.exe
2444	PING.EXE
1600	cmd.exe
3216	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3216	PING.EXE
2444	PING.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 5428	4684	2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4684 wrote to memory of 3596	4684	2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 3596 wrote to memory of 2444	3596	cmd.exe	92
PID 5428 wrote to memory of 1600	5428	DKUVGZZSEP.exe	93
PID 1600 wrote to memory of 3216	1600	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\DKUVGZZSEP.exe
  "C:\Users\Admin\AppData\Local\Temp\DKUVGZZSEP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\DKUVGZZSEP.exe"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 6000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\2026-08-10_01f5a63eb445549b2584007c7bd2fc5e_cobalt-strike_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DKUVGZZSEP.exe

Path C:\Users\Admin\AppData\Local\Temp\DKUVGZZSEP.exe
Size 6.7MB
SHA256 506944752fe367e037b348c08733a771767a586aace50b4b810cdc598cceacc0
MD5 14f701c9ca2ee58fa43bb9d3b76d7b0e
SHA1 0e1f58b4c3f0e0e2451b299313be2d134e3b54c6
SHA512 1ffea2445ba2774770c430acc787b027b6d87889566bf163acab77ba332171a21a15a38682e3a0511f7c8e2fb44c2b9abc90f51ffe4af62d9e487d051346fda6
SSDEEP 98304:upK/6r6rZtqzA2yXN++IlVNTcQrovaTUgqwTXZFZnv1/ul6T68BSevNettIU:uBr6vO78NyXcQ0vyTBjt/ul6+8BveDIU
TLSH
T12C663369735418FCE873407A99524804DA727C665736DCBB17B48B0DCF73AA09E3EB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download