fe3c01f1d987c8fa8866e58aba695430402284fe1152e7a608e67df1eeb5633c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:02

Target
2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe
Size 904KB
Sample261024-sefa7sct5n
SHA256 fe3c01f1d987c8fa8866e58aba695430402284fe1152e7a608e67df1eeb5633c
MD5 43bdcea332dba1920df372f1bbc307f8
SHA1 90cc05ca3ee245977d680308f73ceb4623748e55
SHA512 2d443829ad7690475e348fe19ae2d86e84506883a61684b305c64400863b77bfccab3758498506680ea2fd8fd8d4b5a4575b84382cbe62fc2d7b29c563d18e97
SSDEEP 12288:P8CKhrggNk5a22dtw8SS1n3EVpnO1Ip6oGb+wbz2A4UA1s+r7MRnLoGXT:P8lq2DwHun3gO1r0Ucs+sRnL9j
TLSH
T170159D49A2A481F9F463907C8866E107F5713849C750CADF67E44A563FB72E06ABF332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe
1744	2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4212	1744	2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc.exe"
  2⤵
  PID:4212