Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 7.5MB
- Sample260822-ea7b8svwcx
- SHA256 59c61e2083f038a433c1e70f442049eca88358cfd1b3ff6a9bf03ed6551bf33b
- MD5 a1bdf11b86ead7295c544d5d1b004a8b
- SHA1 32e780107ab21797e2743377efe09ca8a76b87b5
- SHA512 eba80b1fda14f3cfd3809954b9105e78e86fda0356e4b135c3d84e859a888f6861eb3d6fa9c0c0012899fc5b75a7c6bdae43cf98929b2bbf786febd5b74d2352
- SSDEEP 98304:i3uxgMJYPG61nRonEve6MYdCFLOAkGkzdnEVomFHKnP:rxsPGS8pYdCFLOyomFHKnP
- TLSH T1C3765C06ABBD00D4E07AD078CA57561AF9B27C90473497DB4351968BAF33BE09E3E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3108 wmic.exe 3108 wmic.exe 3108 wmic.exe 3108 wmic.exe 1612 wmic.exe 1612 wmic.exe 1612 wmic.exe 1612 wmic.exe 5364 wmic.exe 5364 wmic.exe 5364 wmic.exe 5364 wmic.exe 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 2476 wmic.exe 1968 wmic.exe 1968 wmic.exe 1968 wmic.exe 1968 wmic.exe 5568 wmic.exe 5568 wmic.exe 5568 wmic.exe 5568 wmic.exe 1256 wmic.exe 1256 wmic.exe 1256 wmic.exe 1256 wmic.exe 4412 wmic.exe 4412 wmic.exe 4412 wmic.exe 4412 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3108 wmic.exe Token: SeSecurityPrivilege 3108 wmic.exe Token: SeTakeOwnershipPrivilege 3108 wmic.exe Token: SeLoadDriverPrivilege 3108 wmic.exe Token: SeSystemProfilePrivilege 3108 wmic.exe Token: SeSystemtimePrivilege 3108 wmic.exe Token: SeProfSingleProcessPrivilege 3108 wmic.exe Token: SeIncBasePriorityPrivilege 3108 wmic.exe Token: SeCreatePagefilePrivilege 3108 wmic.exe Token: SeBackupPrivilege 3108 wmic.exe Token: SeRestorePrivilege 3108 wmic.exe Token: SeShutdownPrivilege 3108 wmic.exe Token: SeDebugPrivilege 3108 wmic.exe Token: SeSystemEnvironmentPrivilege 3108 wmic.exe Token: SeRemoteShutdownPrivilege 3108 wmic.exe Token: SeUndockPrivilege 3108 wmic.exe Token: SeManageVolumePrivilege 3108 wmic.exe Token: 33 3108 wmic.exe Token: 34 3108 wmic.exe Token: 35 3108 wmic.exe Token: 36 3108 wmic.exe Token: SeIncreaseQuotaPrivilege 3108 wmic.exe Token: SeSecurityPrivilege 3108 wmic.exe Token: SeTakeOwnershipPrivilege 3108 wmic.exe Token: SeLoadDriverPrivilege 3108 wmic.exe Token: SeSystemProfilePrivilege 3108 wmic.exe Token: SeSystemtimePrivilege 3108 wmic.exe Token: SeProfSingleProcessPrivilege 3108 wmic.exe Token: SeIncBasePriorityPrivilege 3108 wmic.exe Token: SeCreatePagefilePrivilege 3108 wmic.exe Token: SeBackupPrivilege 3108 wmic.exe Token: SeRestorePrivilege 3108 wmic.exe Token: SeShutdownPrivilege 3108 wmic.exe Token: SeDebugPrivilege 3108 wmic.exe Token: SeSystemEnvironmentPrivilege 3108 wmic.exe Token: SeRemoteShutdownPrivilege 3108 wmic.exe Token: SeUndockPrivilege 3108 wmic.exe Token: SeManageVolumePrivilege 3108 wmic.exe Token: 33 3108 wmic.exe Token: 34 3108 wmic.exe Token: 35 3108 wmic.exe Token: 36 3108 wmic.exe Token: SeIncreaseQuotaPrivilege 1612 wmic.exe Token: SeSecurityPrivilege 1612 wmic.exe Token: SeTakeOwnershipPrivilege 1612 wmic.exe Token: SeLoadDriverPrivilege 1612 wmic.exe Token: SeSystemProfilePrivilege 1612 wmic.exe Token: SeSystemtimePrivilege 1612 wmic.exe Token: SeProfSingleProcessPrivilege 1612 wmic.exe Token: SeIncBasePriorityPrivilege 1612 wmic.exe Token: SeCreatePagefilePrivilege 1612 wmic.exe Token: SeBackupPrivilege 1612 wmic.exe Token: SeRestorePrivilege 1612 wmic.exe Token: SeShutdownPrivilege 1612 wmic.exe Token: SeDebugPrivilege 1612 wmic.exe Token: SeSystemEnvironmentPrivilege 1612 wmic.exe Token: SeRemoteShutdownPrivilege 1612 wmic.exe Token: SeUndockPrivilege 1612 wmic.exe Token: SeManageVolumePrivilege 1612 wmic.exe Token: 33 1612 wmic.exe Token: 34 1612 wmic.exe Token: 35 1612 wmic.exe Token: 36 1612 wmic.exe Token: SeIncreaseQuotaPrivilege 1612 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3108 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 89 PID 2868 wrote to memory of 1612 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 92 PID 2868 wrote to memory of 5364 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 94 PID 2868 wrote to memory of 2476 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 96 PID 2868 wrote to memory of 1968 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 98 PID 2868 wrote to memory of 5568 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 100 PID 2868 wrote to memory of 1256 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 102 PID 2868 wrote to memory of 4412 2868 2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1bdf11b86ead7295c544d5d1b004a8b_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\System32\Wbem\wmic.exewmic memorychip get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\System32\Wbem\wmic.exewmic memorychip get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5364
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
-
C:\Windows\System32\Wbem\wmic.exewmic memorychip get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5568
-
-
C:\Windows\System32\Wbem\wmic.exewmic memorychip get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256
-
-
C:\Windows\System32\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-