f9c9cd9926094027a200afdc4f47ef7af9b5d7c512b8da44e4183f1f0493e6d6

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_eac45605c37c36376f99597e4b3030d2_cobalt-strike_icedid_njrat_vidar.exe
Size 2.2MB
Sample260930-svwm5abe83
SHA256 f9c9cd9926094027a200afdc4f47ef7af9b5d7c512b8da44e4183f1f0493e6d6
MD5 eac45605c37c36376f99597e4b3030d2
SHA1 011694d4f92008d330804d380893b11ff74690be
SHA512 a02cfa8c5b4ce2987090cbc073d35314d7dec89529f1c1ede5fd67edb3bfbbf9c323b7cc7fb44a281046afa30e13c9d738394238ba52e8f9db50710f00f9cf34
SSDEEP 24576:AJKdZPkgI3tcqnH8iScS9gRlDmjbN3cBPMkkkkIHl:eKd1kgynH8iScS9gLDmjbN3fkkkkE
TLSH
T1C8B50636F277A6B3D78241FA594EA5B09A2D6C773622434A315F32083F729DC82F6135
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
684	eclipse-inst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 684	4536	2026-09-29_eac45605c37c36376f99597e4b3030d2_cobalt-strike_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-29_eac45605c37c36376f99597e4b3030d2_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_eac45605c37c36376f99597e4b3030d2_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\eclipse-inst.exe
  "C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\eclipse-inst.exe"
  2⤵
  - Executes dropped EXE
  PID:684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

eclipse-inst.exe

Path C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\eclipse-inst.exe
Size 520KB
SHA256 1542552bd4828019c7f38fe1ac8a8015911391b75499c35c78710241afafc6f8
MD5 66ca1e0b284dbec05f53970f27d79370
SHA1 6d29fba5c1dd2fe4affb927086afaf18afd49689
SHA512 6cc157b7f2bd2c41e64f53b0ae481f1d8b2d7ba72c0d5c7a6db19aa8a2049ffdb35191ee21a491c5618efdefd937bda7c19d802261374007292321ac09e93f0a
SSDEEP 3072:xinw2dQFiLMJpnzVAgCkr/BJkKsy7y3PpuM09oxAJteJD5UIJ7YNK23bGgYltFmL:cnVjCVAHkjBJ8oaYboxkQr7Y0237L
TLSH
T12FB4C170F273B8A7D46641FF8819E131856D6C323622875A32AF3266BF325CD49F9631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eclipse-inst.ini

Path C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\eclipse-inst.ini
Size 437B
SHA256 011eba6de47c1b5bfb0182aca0115590ec04640c252fb21b788cf2e0b5941116
MD5 eb1439fc41aa329df2ee43faadda9387
SHA1 799c814c5094eb5dda50cbcd398a964dfb15f256
SHA512 0550bc6f968be818d93160423e08ff76ff5611409dbfb94ced9baabc0d7d7a7df3152ba5f0afd48776f8025c9f3d648f08d005d0b9ed1f1ebe964c913cf78d36
TLSH
T12FE0E507E2D11AE01B550381979D137E1AD92A8E5880B8244AB245EECD7F86F6E91455
MD5 SHA1 SHA512 TLSH

Submit Download

ECLIPSE_.RSA

Path C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\features\org.eclipse.ecf.core.ssl.feature_1.1.501.v20230507-1921\META-INF\ECLIPSE_.RSA
Size 9KB
SHA256 adf132b2be837cc7cd928a8f4b041b159c3c7e370819a9d0c581daa71b49b92c
MD5 55dc51c40d2cf91f7b6b92d0d78385c0
SHA1 501a7bbbba770161157fb46e46852ba7a15c245b
SHA512 3c2ee8f1e8f6e355488304485da296c0f03093900f6f27a8e2aaf00ff4b0fd834f65938b80474ae0054c06cab5dea91317d1ac94436af8a183974121bf25d178
SSDEEP 192:YDbnPIIYiYF8CUSwv7s8jtGz3qlZgizfwfH0JOqsmVgz28WhBq5F:YHQIYiYU873q9zY8JN77hh4F
TLSH
T121125BD70A245C01DF47DE86B1C4D27A6D74B7D1AAE1C1C750ACD1925FC978A2F9807C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epl-2.0.html

Path C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\features\org.eclipse.ecf.filetransfer.feature_3.14.1800.v20230422-0242\epl-2.0.html
Size 16KB
SHA256 928c4a6af7e9cf82589e560f98ffbb6ade7385b59fec8cb4ef36a6bb91cf7018
MD5 84283fa8859daf213bdda5a9f8d1be1d
SHA1 0cbef63aebcfcd4cd201ebeb48ce294e377a6321
SHA512 f4eb2bb38fa8c40b44c714e05b518ded3641529d689552b131613a40a64940d0369263f3afde03a7d289dd88e38c50975527103fc43eb32984e84e8236ab9feb
SSDEEP 384:9GHgpMKQ+18r4TtQSbgF8NRj9qQAA99Sf20qzJe:94Q1zx97AA9I7qzJe
TLSH
T1117294BB675C13B25AC201518F475ED4E70AE82F32A91125319C825DAF9BE3083BF26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.html

Path C:\Users\Admin\AppData\Local\Temp\eoi3735.tmp\features\org.eclipse.ecf.filetransfer.feature_3.14.1800.v20230422-0242\license.html
Size 9KB
SHA256 0efe4d6eb579f748857a93c5a781c3000f70f339074b29d15b914213e14b1d53
MD5 618d2440fc58e15450a9416cd6804477
SHA1 c501b7ce0b1ee46ad86fff436bcb7dc2cd549dc2
SHA512 7b48c3911305756ad7d7bf65e5254c5151f619fdd16cd80be01208a8e868f02066a91a872c17824537e6173d9e0cb81c1c5b0081cea6c1cd585c91bcddf6438a
SSDEEP 192:BZ0w2JhxioaA5SFB6NiH23Ab+yAZ9RZW1s1dVDjAkCRfaEY+MAN:BZkp7awSFB6wH5+1d1XCcx+RN
TLSH
T16C12C66E73691773034E93693C9B17C92F3F639AA65423D85419012CB7B3A6082FB1F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4536-109-0x0000000000400000-0x000000000045C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads