Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/09/2026, 02:23
General
- Target 2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 1.2MB
- Sample260913-cvasnadh43
- SHA256 648353807281c1f08d82e8d038792c04993c13d30463e193afd2313f03092bf7
Malware Config
Signatures
- UPX dump on OEP (original entry point) 44 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe 410238025E02570271026702700271025E02430266026F026B026C025E0243027202720246026302760263025E0250026D0263026F026B026C0265025E026A02680265026402740268027B0264025E024C0269023402370260025D02710231023A024F0256026A027A025E02630249023702500230025B02--ao\`2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hjgfvjyf\Nk65b_s38MThx\aK5R2Y.exe"C:\Users\Admin\AppData\Roaming\hjgfvjyf\Nk65b_s38MThx\aK5R2Y.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aK5R2Y.exe
aK5R2Y.txt
simpropace.dll
memory/3732-8-0x0000000010000000-0x0000000010068000-memory.dmp
memory/3732-9-0x0000000000670000-0x0000000000671000-memory.dmp
memory/3732-10-0x0000000000530000-0x0000000000531000-memory.dmp
memory/3732-11-0x0000000000680000-0x0000000000681000-memory.dmp
memory/3732-12-0x0000000010000000-0x0000000010068000-memory.dmp
memory/3732-13-0x0000000010000000-0x0000000010068000-memory.dmp
memory/3732-14-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-15-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-17-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-18-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-19-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-20-0x0000000010000000-0x0000000010068000-memory.dmp
memory/3732-21-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-22-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-23-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-24-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-25-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-26-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-27-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-28-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-29-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-30-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-31-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-32-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-33-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-34-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-35-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-36-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-37-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-38-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-39-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-40-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-41-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-42-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-43-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-44-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-45-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-46-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-47-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-48-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-49-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-50-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-51-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-52-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-53-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-54-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-55-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-56-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-57-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-58-0x0000000002430000-0x0000000002517000-memory.dmp
memory/3732-59-0x0000000002430000-0x0000000002517000-memory.dmp