931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 19:09

Target
2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe
Size 8.5MB
Sample260905-xt7ffsgr9v
SHA256 931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690
MD5 087711001fd83790aeee5624f683e853
SHA1 2c95ba7bf9623051aa27e11177371ebe5fd3d0aa
SHA512 19651cd72eb9dec6ecc945aaf4e6c800235b0e4486f9888728f050bdd1e70343003fe83a5dffba38878ccf3705dc5f685d82a63d5e7b33663031e8e1c7b0c94b
SSDEEP 98304:Uh/tz1kqApyvB+0A87IlF1oekyXQFCDfU2rTZmwwrdvtFGcRu:Uv+qApyvBRWaekIrDvrTlUJbRu
TLSH
T15796E0AEE14DEFC9E017133ED5407EB262DD45299F906CEB60894C481EAFEC9583A34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1564	2360	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	89
PID 2360 wrote to memory of 2644	2360	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	91
PID 2360 wrote to memory of 5724	2360	2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe"
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe"
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe
  "C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe"
  2⤵
  - Executes dropped EXE
  PID:5724

R4L_07618042.exe

Path C:\Users\Admin\AppData\Local\Temp\R4L_07618042.exe
Size 6.7MB
SHA256 715856d6d3b03ac52059d43efee726d16e19d9d331ae662d76da0d7e5f780e02
MD5 8d0871a665dce4746348c97f008e227a
SHA1 c618277cdfcdb2ffee55955783ab9605283461be
SHA512 094a76e7e6e40d04adf3ecdce1634cb5f2cdf2338d53c39ccdb1503ed03e29ee52cdd4b7dcd189103856661cc6176d1e23f255f728b45a5db6b49e8baba6f18b
SSDEEP 98304:6ZPugmYtBhkC7SlGp4jo/Y7mgTm05AwJHE6hvpiN3lZqL9PlFAP:6ZPDqzlQg7PAmke8zZqL1lF4
TLSH
T12666CF43F3A2C5A9D2568538CA92D367D2717C180B3652EB339C7A1BAF736D08EB5701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download