Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 02:23
General
- Target 2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 1.2MB
- Sample260913-cvasnadh43
- SHA256 648353807281c1f08d82e8d038792c04993c13d30463e193afd2313f03092bf7
Malware Config
Signatures
- UPX dump on OEP (original entry point) 17 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-09-12_493453fd11978b6e84b4956c93d464e7_cobalt-strike_icedid_njrat_satacom_vidar.exe 42013B015D01540172016401730172015D01400165016C0168016F015D0140017101710145016001750160015D0153016E0160016C0168016F0166015D0169016B016601670177016B01780167015D0134014F0132015B0167016E01630135015E0134015401630151016D0133015D01320177014A016A0137014401--ao\`2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hjgfvjyf\5N3Zfob4_5UbPl2\3vKk6E.exe"C:\Users\Admin\AppData\Roaming\hjgfvjyf\5N3Zfob4_5UbPl2\3vKk6E.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3vKk6E.exe
3vKk6E.txt
simpropace.dll
memory/932-23-0x0000000003E90000-0x0000000003F7B000-memory.dmp
memory/932-28-0x0000000004530000-0x00000000046A5000-memory.dmp
memory/932-11-0x0000000000570000-0x0000000000571000-memory.dmp
memory/932-12-0x0000000010000000-0x0000000010068000-memory.dmp
memory/932-13-0x0000000010000000-0x0000000010068000-memory.dmp
memory/932-14-0x0000000000E40000-0x0000000000F27000-memory.dmp
memory/932-17-0x0000000000E40000-0x0000000000F27000-memory.dmp
memory/932-9-0x0000000000560000-0x0000000000561000-memory.dmp
memory/932-15-0x0000000000E40000-0x0000000000F27000-memory.dmp
memory/932-18-0x0000000003A90000-0x0000000003C91000-memory.dmp
memory/932-22-0x0000000010000000-0x0000000010068000-memory.dmp
memory/932-8-0x0000000010000000-0x0000000010068000-memory.dmp
memory/932-24-0x0000000003E90000-0x0000000003F7B000-memory.dmp
memory/932-10-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/932-30-0x0000000003FB0000-0x0000000004002000-memory.dmp
memory/932-27-0x0000000004530000-0x00000000046A5000-memory.dmp
memory/932-26-0x0000000004480000-0x0000000004526000-memory.dmp
memory/932-32-0x0000000000E40000-0x0000000000F27000-memory.dmp
memory/932-31-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
memory/932-33-0x0000000003A90000-0x0000000003C91000-memory.dmp
memory/932-34-0x0000000003FB0000-0x0000000004002000-memory.dmp
memory/932-35-0x0000000003A90000-0x0000000003C91000-memory.dmp
memory/932-36-0x0000000010000000-0x0000000010068000-memory.dmp
memory/932-37-0x0000000003E90000-0x0000000003F7B000-memory.dmp
memory/932-38-0x0000000004480000-0x0000000004526000-memory.dmp
memory/932-39-0x0000000004530000-0x00000000046A5000-memory.dmp
memory/932-40-0x0000000003FB0000-0x0000000004002000-memory.dmp