b1d55dadae37aed55637e614f108b156d404da9741dfb4028fa7e957b9824b47

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 11:38

Target
2026-09-24_3d106dcb7156b6aa48228096e0fda407_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 871KB
Sample260925-nrxc2avdnd
SHA256 b1d55dadae37aed55637e614f108b156d404da9741dfb4028fa7e957b9824b47
MD5 3d106dcb7156b6aa48228096e0fda407
SHA1 2172402983f6f608985433fb3ea581b8015a25b3
SHA512 e75802d6013a4db3495140cdb63b9b1effda2a10dad133c8efab74bd8f65ec9ed59f7faaa2e03774370148c274a20fd88bbebe4647efa1da3081b5cf5e9e2b1d
SSDEEP 12288:F3XAyIeGhC0J4VQccG2QRXDD1yed0fsU4GSWQOvPESGj4s32xEdRCSz:KyXGh6xZ2Q9NXw2/wPOjdGxY
TLSH
T1F0151B139D548B93E42983F8BE130E6C6F5B6B1CE5913AFF11650ECB7E212124C9E52E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3372	1096	2026-09-24_3d106dcb7156b6aa48228096e0fda407_cobalt-strike_elex_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-24_3d106dcb7156b6aa48228096e0fda407_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_3d106dcb7156b6aa48228096e0fda407_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 780
  2⤵
  PID:3372

memory/1096-0-0x00007FFDB41FA000-0x00007FFDB41FB000-memory.dmp

Download

memory/1096-1-0x00007FFDB3F00000-0x00007FFDB4938000-memory.dmp

Download

memory/1096-2-0x00007FFDB3F00000-0x00007FFDB4938000-memory.dmp

Download

memory/1096-5-0x00007FFDB3F00000-0x00007FFDB4938000-memory.dmp

Download