Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 485KB
- Sample261104-2fekqsdy5w
- SHA256 37ab4acba8576078af8d17be51c2c70f0c565d876095058a0d2af28a61be3732
- MD5 42a6da375985a0dfbe9b71b43192b6ba
- SHA1 837e92eb9cf21b30cf474ede34130066b25498cf
- SHA512 55cea2a1ebd68a18a881c8be80e8edaf2d5fec07f7422adec244779e195e695d8cd82415ef666fbb796c1def35280e3488305fb7b40e87beb0d01a7a8b53818a
- SSDEEP 12288:ivudzp3hlVZGIMqvEwF6Y5adnTATsSb2GBsXO0vzmEl:5p3vVWqvEG6iadn8YxGeXFzz
- TLSH T1C7B4D007FFE179E9E02E86359032507363B3743267D4DBEB56D486260E725906F3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 64 set thread context of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84 PID 64 wrote to memory of 968 64 2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_42a6da375985a0dfbe9b71b43192b6ba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵PID:968
-