d20f144217491e90c23ab72409628feffdef0a997bda909cae4c028b083a1a42

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 09:05

Target
2026-08-12_0116d986a42acafb0c62d5e3a9d80c38_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 472KB
Sample260812-k2md2atapd
SHA256 d20f144217491e90c23ab72409628feffdef0a997bda909cae4c028b083a1a42
MD5 0116d986a42acafb0c62d5e3a9d80c38
SHA1 bb9d0934fbeab98460e6f3b9175b943620bf1910
SHA512 afee1784cf9385f9c069491d7178399f445d1bfd961f8a223e683dc9d8ba3eeff23e7df1de6dfb49f746fe699ed1e7d24e9861d661e094b36b77c8acfdac2509
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvW:Vi4e7WRdTfgwCHKy7GLbbdIvW
TLSH
T1D7A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	javaws.exe
4924	javaws.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4924	4788	2026-08-12_0116d986a42acafb0c62d5e3a9d80c38_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0116d986a42acafb0c62d5e3a9d80c38_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0116d986a42acafb0c62d5e3a9d80c38_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-12_0116d986a42acafb0c62d5e3a9d80c38_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924