f23164c63fdf67419909523e4bce6b12e2e504e9055553967dd502a9e7c21036

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:39

Target
2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
Size 14.3MB
Sample261102-2lc9vsdw5y
SHA256 f23164c63fdf67419909523e4bce6b12e2e504e9055553967dd502a9e7c21036
MD5 cb2641dfd8ca2c515ebb2bf11c6f5373
SHA1 8a2726a392e5291216407ea32aa99880e0883bb1
SHA512 4daa3e3b66ec8bd18eb34706a59b7a792d9f49c893c0abecffad4863baf20ec2830fe38f2efdba968ed2325aef65ec559dd819ec008c079ba3b3a1b52beeb115
SSDEEP 196608:jYmzYByDMwK3SH9ot+VVUqQIpi9h+z8idkYGF1:UmBwSH9yxX4zgYGF
TLSH
T1DDE63FE7D0E87B2D54B14AFD3AB97923DE6E21236A64418839CD05136FF28F04D678D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5632	2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
5632	2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5632