4155736aa0a1fff860ab7296f19a8b7319c1bf0daa15f2a6ac2a1b2617ddc03d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:56

Target
2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Size 7.2MB
Sample260810-m1zdbaff46
SHA256 4155736aa0a1fff860ab7296f19a8b7319c1bf0daa15f2a6ac2a1b2617ddc03d
MD5 0423666413d7acc55308d1f31179ebef
SHA1 d9d92a74566d2c4175f9ae6949df658a5755963c
SHA512 92c72a209909557b4bf1bba2346273e722b334404e47242df22460987000c7b7e2400675b39859ea65f0a76895fb88985356f8df3e11981da6defbd464cac832
SSDEEP 98304:YbISB5v/OAv+ZuP/W873FfIiUw2A7Ygonbw7K:YbISP3O8+Yf3FbKALEs7K
TLSH
T13E76AE47F242A0FCC45AC4749B47E77766257C8A0F2169DB62D46A3A3EB27E00F39709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1876	2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
1876	2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
1876	2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
1876	2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876