6cfe397b3004d59fedae6e9c50c5776239cdc42cb71413b943b692999198daaa

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_65a818147e22c9132a9cf45fe1aff642_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 526KB
Sample261002-qe4mpayzcs
SHA256 6cfe397b3004d59fedae6e9c50c5776239cdc42cb71413b943b692999198daaa
MD5 65a818147e22c9132a9cf45fe1aff642
SHA1 3887f42cd5e64b6e1bee47fcd70635758e0bb0ab
SHA512 672ca0f86a387f41254ad2d22fc38381dc89a06fda4961c4e84b14fe4cbd65fe13c537272f46a89fbd581c640b9a4903fcf59e284212879c3d8edf4e7a8e779e
SSDEEP 6144:qj3iVUQ508kLJdnPSr9If+asePlzjF4xCBDvAsREykTzO9Tq8oh210vvt//:qj3K7Cd0IvssFdDoeFXo9vx
TLSH
T120B46B4AA2AD43FDE07BA07CD9475A42F639744603B18AEF039105B31E671E1AF7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
576	Cnovwejw.exe
4524	Cnovwejw.exe
1284	Cnovwejw.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Cnovwejw.job	2026-10-01_65a818147e22c9132a9cf45fe1aff642_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Cnovwejw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Cnovwejw.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 576	2284	2026-10-01_65a818147e22c9132a9cf45fe1aff642_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-01_65a818147e22c9132a9cf45fe1aff642_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_65a818147e22c9132a9cf45fe1aff642_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe
  "C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:576

C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe
"C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe"
1⤵
- Executes dropped EXE
PID:4524

C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe
"C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe"
1⤵
- Executes dropped EXE
PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cnovwejw.exe

Path C:\Users\Admin\AppData\Local\Temp\54802595c2\Cnovwejw.exe
Size 526KB
SHA256 6cfe397b3004d59fedae6e9c50c5776239cdc42cb71413b943b692999198daaa
MD5 65a818147e22c9132a9cf45fe1aff642
SHA1 3887f42cd5e64b6e1bee47fcd70635758e0bb0ab
SHA512 672ca0f86a387f41254ad2d22fc38381dc89a06fda4961c4e84b14fe4cbd65fe13c537272f46a89fbd581c640b9a4903fcf59e284212879c3d8edf4e7a8e779e
SSDEEP 6144:qj3iVUQ508kLJdnPSr9If+asePlzjF4xCBDvAsREykTzO9Tq8oh210vvt//:qj3K7Cd0IvssFdDoeFXo9vx
TLSH
T120B46B4AA2AD43FDE07BA07CD9475A42F639744603B18AEF039105B31E671E1AF7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download