060c21558cde852bb70151f6d2915a35866b8bd27dc2f9984c8d57ab4be62e11

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe
Size 108KB
Sample261022-xtdhdaez2x
SHA256 060c21558cde852bb70151f6d2915a35866b8bd27dc2f9984c8d57ab4be62e11
MD5 8473d09088077c33187a57f16f02dda1
SHA1 b37ffe0bfcea0f4694c8b2851e1301935f2c03aa
SHA512 1111ae6f8673ed8e16dca06bcd790bf0d4994014d57cd04813208b9eafff200a57b7cfafd0ea8f598dcad0439e58ff639d4e78fc3136e25473212c02ed286281
SSDEEP 1536:R3iJ3PbYpmcXEwj58iKjLESFsTHdS3J+ppalykJlIwE3sWTlZds9dlkOwx5xrb:RyWsSGLEN9oWpalplIvRlzETwxjb
TLSH
T194B3396B63B530F8E0B68638C5554A55E772FC714761AFAF03A0469A1F236E08D3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NcxxVbctEok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe"	2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe"
1⤵
- Adds Run key to start application
PID:5012

C:\Users\Admin\AppData\Local\Temp\2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-21_8473d09088077c33187a57f16f02dda1_cobalt-strike_icedid.exe
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads