Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 05:46
Behavioral task
behavioral1
Sample
2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
- Size 645KB
- Sample261024-ggmyaaed28
- SHA256 be44bb97bc8caadb0c509da6aa1c16ed3594673aff41242d7f44b5287656e32e
- MD5 8900925b5457a8a0aa26e88a79a1d17f
- SHA1 aaee7699b2c82a5461fdf8e2101593722e76b949
- SHA512 6318feca15050aaa8a7094f74c6c2d71f1b433370e86b632699cb40953ccc4db39d87c314f351bc564a3ca50dad5a3dc07f5feb7976659c7566db52c9fef4773
- SSDEEP 12288:CIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3AoL5aDz:B5GXkH4nnwitNfuq9wgs3y3V5vgNyo3x
- TLSH T1AAE46D59A39402F8D0B7C135CA82852BE7B27C065571572F03D70E9B2F277A16F2EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8900925b5457a8a0aa26e88a79a1d17f_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3864