e166a163f47320c76affe5a1c8ca47f759bafcb6d346f99c61af93bdd66c79c0

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_bb3125cbc0de3cdd8b8b9c9437354da4_cobalt-strike_icedid.exe
Size 541KB
Sample260818-nlbjdagg99
SHA256 e166a163f47320c76affe5a1c8ca47f759bafcb6d346f99c61af93bdd66c79c0
MD5 bb3125cbc0de3cdd8b8b9c9437354da4
SHA1 fd80460861a684e2957d165c5906fca9e823bd3f
SHA512 d6d8faf745042c26e99c22405dcf4486a68dfd8a70c9a2f3217c88da8823dc3b1828fa61736bc665db3a351dd0d54604b48815238ecbb8bd4b624e9e7a73fd3a
SSDEEP 6144:ofk75235nFtaCww05Ri55ZinEUbeR3ixE2/obJtDVBd9U:6kELJW5E554D6R3im7ZBXU
TLSH
T1C1C40346DF10E5ACF4A08FF1754DCD858BBA2D21550DAAC60A17F58A0EFF2F20C6AE51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3412	vzvbax.exe
2872	vzvbax.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5152	schtasks.exe
1920	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 3412	1060	2026-08-18_bb3125cbc0de3cdd8b8b9c9437354da4_cobalt-strike_icedid.exe	90
PID 3412 wrote to memory of 700	3412	vzvbax.exe	91
PID 3412 wrote to memory of 5152	3412	vzvbax.exe	93
PID 2872 wrote to memory of 1508	2872	vzvbax.exe	97
PID 2872 wrote to memory of 4832	2872	vzvbax.exe	99
PID 2872 wrote to memory of 1920	2872	vzvbax.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-18_bb3125cbc0de3cdd8b8b9c9437354da4_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_bb3125cbc0de3cdd8b8b9c9437354da4_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Public\k8bp46qbsq\vzvbax.exe
  "C:\Users\Public\k8bp46qbsq\vzvbax.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc"
    3⤵
    PID:700
- - C:\Windows\system32\schtasks.exe
    C:\Windows\system32\schtasks.exe /create /tn "WindowsUpdateSvc" /tr "\"C:\Users\Public\k8bp46qbsq\vzvbax.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152

C:\Users\Public\k8bp46qbsq\vzvbax.exe
"C:\Users\Public\k8bp46qbsq\vzvbax.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc"
  2⤵
  PID:1508
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /query /tn "WindowsUpdateSvc1"
  2⤵
  PID:4832
- C:\Windows\system32\schtasks.exe
  C:\Windows\system32\schtasks.exe /create /tn "WindowsUpdateSvc1" /tr "\"C:\Users\Public\k8bp46qbsq\vzvbax.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mwylmlbnn.wpp

Path C:\Users\Public\k8bp46qbsq\mwylmlbnn.wpp
Size 6KB
SHA256 beebf39b9219dcdf927c236511fdbe88700f468cc3a2094744665cc2e8409634
MD5 c0aa51489abbb1e1d7822458e7fa962c
SHA1 bfe5ef44b9ed0079f9301af22abcd074a674f44c
SHA512 d929edd3a7dc45d633a1fac160c00ae124954d2f72167c58e19d147e36733016039ab837c4e9124b92115f8aaed5743debe7b7f23e7fc1d6fe2cc0e496aa7441
SSDEEP 192:2GzhD0S2BQba5JP1U7GflF9XAkuckYJsN/J:2MSS2BQbCPjAnIyx
TLSH
T15FD18EBA36A041CB456CA812F3A8FA726176E0B0FC6DBA7021753F4B805663B7643716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vzvbax.exe

Path C:\Users\Public\k8bp46qbsq\vzvbax.exe
Size 255KB
SHA256 671de22f3a34c7c0d10ea1c8527c43a8e0112b53c0be4136c79450b2df5dede8
MD5 0b80aed3d5028b10f05fbcc9c48a228f
SHA1 53dd8ac91683e3d3220d7e24a5357ac0bb6c3e35
SHA512 d199042559bb9f6ce40700e886f424ae6c0f8850278188f817b3bdb227a76bfdff17df68e2497802592dc0e04ce24b4315d3bea50e10daf33bf58926a420a75f
SSDEEP 3072:vFVvwvYELDZVsyUsXmZBekyMNX/oxYz323:vzgYEkyUCwekytYg
TLSH
T14644289791A131F4E0A2CE3581115A74C773BD729B18FBAF1650B29B0F335D26C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-6-0x000002088D040000-0x000002088D042000-memory.dmp

Download

memory/3412-8-0x000002088D040000-0x000002088D042000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads