84f28af33a10d1b65fd7fb15276312a000e96d6abc262bdc80d0f908ba97f821

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe
Size 111KB
Sample260910-elljxafc38
SHA256 84f28af33a10d1b65fd7fb15276312a000e96d6abc262bdc80d0f908ba97f821
MD5 94cd371c73d7b54729cf7ecb67b254ec
SHA1 c0d8a917081d9b222fe34fbf73e77f2c04c5ba4e
SHA512 96f990d4eaea6e56c32093137a393e4f38df4a835ca00bb1f7d80b0149639bfd1f13da5e38dfb6f779debdaf33fd61107729ea8e48ec713c2a86931d9396345a
SSDEEP 1536:d4cub9bluxDttzVEBjD+PUdvKH22THES+MOE9ic7n4od/wRIsWwdp9dlJn7exx+0:Gcu25mpDdvvukVMXic74k/qPBLix+Vu
TLSH
T185B35B5762F630F8E57B927588520A49E772B87157609FEF03A0075A1F236E18D3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1196	2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe
1196	2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_94cd371c73d7b54729cf7ecb67b254ec_cobalt-strike_icedid.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads