86236981cd7bce9e8c0becabf8b283116e6dd3b01a53d54c2f04f1aba809566e

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:04

Target
2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
Size 6.7MB
Sample261030-dkqlssvxev
SHA256 86236981cd7bce9e8c0becabf8b283116e6dd3b01a53d54c2f04f1aba809566e
MD5 6601ad9cd30604168d190f527d2ba521
SHA1 51d5d7ded5c584565680189d4f40d54c374ab529
SHA512 fa05bdee74d1db7110c06285447e2557ce737a18f52a2f30293d7dce865a4e8bec5ae2d677d7d2887284a1a03c06cca52fbe969155b601b39d2e330aa4ecf503
SSDEEP 196608:9jmzYByDMwK3SH9ot+VVUqQIpi9h+z8oT6mQ:9mBwSH9yxX4znO1
TLSH
T131660292A3F406ACD1B2D3B8AA766516DA36B847073095DB32C845171F379E4CE3BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4340	2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
4340	2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4340