cobaltstrike | 3bb27e063d93e0f995b38a41bca8af2bac03294a8cb565e1e3507de4ad757f7c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:03

Target
2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 127KB
Sample260824-vkn7eaec34
SHA256 3bb27e063d93e0f995b38a41bca8af2bac03294a8cb565e1e3507de4ad757f7c
MD5 11500ff6c4c6cefb90b6f8c664a0ad89
SHA1 323acc4f16adc702976bad7b2671b96862c512ef
SHA512 8c18d1bad8798f27bf3304c3f892ad74e15ecd843f537f1753bf7b8b6d96bd3bb32690eee682bff6515674ee0c06ea0fe7868b115bab83f399e0103fad9863da
SSDEEP 1536:T1nBNCeFpVr2MbuMERURD8j+1M45nSyqkKpiUTBqODSsWxd7B9dlUvVByC:T1nBN2MCd8D8i1MiPqkKpiUl5wVOvT
TLSH
T169D37D6777F430F9D0728239C9615A4AE772B87606309BAF1398421A5F272D19D3EFB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Attributes

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 5128	3848	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	90

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 5128	3848	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 3848 wrote to memory of 5128	3848	2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_11500ff6c4c6cefb90b6f8c664a0ad89_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:5128