Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 10:17
General
- Target 2026-08-20_2425c6008390a544618c7e4a44e4f7a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 13.2MB
- Sample260820-mbebvacf75
- SHA256 294bc829082c1287a7a41d37d855765cf82a9566e3c3e374d7d1750b5f458761
Malware Config
Extracted
-
gozi
Signatures
- Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
- Detects executables packed with Enigma 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2425c6008390a544618c7e4a44e4f7a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2425c6008390a544618c7e4a44e4f7a8_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evb3E87.tmp
memory/4844-0-0x0000000140000000-0x000000014029A000-memory.dmp
memory/4844-1-0x00007FFBC99FF000-0x00007FFBC9A00000-memory.dmp
memory/4844-2-0x00007FFBC98A0000-0x00007FFBC9B03000-memory.dmp
memory/4844-4-0x00007FFBC98A0000-0x00007FFBC9B03000-memory.dmp
memory/4844-6-0x0000000180000000-0x00000001802B1000-memory.dmp
memory/4844-10-0x00007FFBC98A0000-0x00007FFBC9B03000-memory.dmp
memory/4844-9-0x00007FFBC98A0000-0x00007FFBC9B03000-memory.dmp
memory/4844-11-0x0000000180000000-0x00000001802B1000-memory.dmp
memory/4844-12-0x0000000140000000-0x000000014029A000-memory.dmp
memory/4844-13-0x0000000180000000-0x00000001802B1000-memory.dmp
memory/4844-14-0x00007FFBC98A0000-0x00007FFBC9B03000-memory.dmp