931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 19:09

Target
2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe
Size 8.5MB
Sample260905-xt7ffsgr9v
SHA256 931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690
MD5 087711001fd83790aeee5624f683e853
SHA1 2c95ba7bf9623051aa27e11177371ebe5fd3d0aa
SHA512 19651cd72eb9dec6ecc945aaf4e6c800235b0e4486f9888728f050bdd1e70343003fe83a5dffba38878ccf3705dc5f685d82a63d5e7b33663031e8e1c7b0c94b
SSDEEP 98304:Uh/tz1kqApyvB+0A87IlF1oekyXQFCDfU2rTZmwwrdvtFGcRu:Uv+qApyvBRWaekIrDvrTlUJbRu
TLSH
T15796E0AEE14DEFC9E017133ED5407EB262DD45299F906CEB60894C481EAFEC9583A34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5768	4588	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	85
PID 4588 wrote to memory of 5900	4588	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	90
PID 4588 wrote to memory of 896	4588	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe"
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe"
  2⤵
  - Executes dropped EXE
  PID:5900
- C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe"
  2⤵
  - Executes dropped EXE
  PID:896

R4L_1FB413E1.exe

Path C:\Users\Admin\AppData\Local\Temp\R4L_1FB413E1.exe
Size 6.7MB
SHA256 715856d6d3b03ac52059d43efee726d16e19d9d331ae662d76da0d7e5f780e02
MD5 8d0871a665dce4746348c97f008e227a
SHA1 c618277cdfcdb2ffee55955783ab9605283461be
SHA512 094a76e7e6e40d04adf3ecdce1634cb5f2cdf2338d53c39ccdb1503ed03e29ee52cdd4b7dcd189103856661cc6176d1e23f255f728b45a5db6b49e8baba6f18b
SSDEEP 98304:6ZPugmYtBhkC7SlGp4jo/Y7mgTm05AwJHE6hvpiN3lZqL9PlFAP:6ZPDqzlQg7PAmke8zZqL1lF4
TLSH
T12666CF43F3A2C5A9D2568538CA92D367D2717C180B3652EB339C7A1BAF736D08EB5701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download