3bb27e063d93e0f995b38a41bca8af2bac03294a8cb565e1e3507de4ad757f7c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 17:03

Target
2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 127KB
Sample260824-vkn7eaec34
SHA256 3bb27e063d93e0f995b38a41bca8af2bac03294a8cb565e1e3507de4ad757f7c
MD5 11500ff6c4c6cefb90b6f8c664a0ad89
SHA1 323acc4f16adc702976bad7b2671b96862c512ef
SHA512 8c18d1bad8798f27bf3304c3f892ad74e15ecd843f537f1753bf7b8b6d96bd3bb32690eee682bff6515674ee0c06ea0fe7868b115bab83f399e0103fad9863da
SSDEEP 1536:T1nBNCeFpVr2MbuMERURD8j+1M45nSyqkKpiUTBqODSsWxd7B9dlUvVByC:T1nBN2MCd8D8i1MiPqkKpiUl5wVOvT
TLSH
T169D37D6777F430F9D0728239C9615A4AE772B87606309BAF1398421A5F272D19D3EFB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 1272	4772	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	84

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1272	4772	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	84
PID 4772 wrote to memory of 1272	4772	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:1272