Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 01:57
General
- Target 2026-10-28_73e390e4d8175be6979c5dabcaa00e11_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 835KB
- Sample261030-cdsbdavy5k
- SHA256 0b7cf29c3d7f517a634be7d6f9f8536e1898e45193a00b5284ea7f1ae9147846
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_73e390e4d8175be6979c5dabcaa00e11_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_73e390e4d8175be6979c5dabcaa00e11_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Creates a file in the Startup directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_73e390e4d8175be6979c5dabcaa00e11_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_73e390e4d8175be6979c5dabcaa00e11_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe" --daemon-child2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-