Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 6.3MB
- Sample260907-ctd4paxbmd
- SHA256 2eac11c1a495669731c71dcdd2c1063be1c4d8e83bc35a72ca99db0b29f663c6
- MD5 606cf5e47f99ea1b97776d6bfd2ea623
- SHA1 2fa8b54cfa1cf2b52a13a619faa57eaeee11e0e8
- SHA512 80b4c8571fdfa2d03c966101dec277e4d4e01b3d87146311952b03eba346d82f0550a913ba2e07a88f1019da6b34ac95d87698e83830f1e44e7e3753d0050d24
- SSDEEP 49152:JtCaDNgx0qZZdxe+7sUYFJVOHvfxahLu1XDyy/6WSQLGaClZfYjBDb8KHJPZNMbW:FNgxBJsdwfYdOglZ+BDZHJPZN/
- TLSH T1E8668D01E967D0E6C477C17947AA22A2F5703D090B2497D793D473A92E327F08AAF3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4620 2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4620 2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 4620 2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_606cf5e47f99ea1b97776d6bfd2ea623_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4620
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\savedata.gmg
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512