5edb5aa2811d4c90fde0cdea9af60b1e0660aa3e8c8b238f5aabd184d5d63ba3

Analysis

max time kernel
150s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 21:25

Target
2026-10-28_aa137fe8f7bae165471c812e3d62f468_cobalt-strike_icedid_njrat_vidar.exe
Size 33.1MB
Sample261029-z92agsce49
SHA256 5edb5aa2811d4c90fde0cdea9af60b1e0660aa3e8c8b238f5aabd184d5d63ba3
MD5 aa137fe8f7bae165471c812e3d62f468
SHA1 60645230370bbd7ea1755fe0b27ff6c3dc87373b
SHA512 f7816a63b298765fd352db2cfb6573767df7947f25e49dba7fe029cc1c6da30a82ecbad43020215e1fa3f1eeadcdefb91d87d1057ef752d2b70951112477185e
SSDEEP 393216:6FpiQcAohA+R/6JKMmiCAsMBg1ONWGMI5au6X2DD15:QUR/6JbDD
TLSH
T1AD77596A7BDC95C4E1F3C2B88E560753A633F824CB3486DB2247429D5D636D88CB6336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_aa137fe8f7bae165471c812e3d62f468_cobalt-strike_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_aa137fe8f7bae165471c812e3d62f468_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_aa137fe8f7bae165471c812e3d62f468_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact