Analysis
- max time kernel
0s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 18:06
Behavioral task
behavioral1
Sample
2026-11-06_fba01d909a31944795fbaceb2e6d9709_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260911-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-06_fba01d909a31944795fbaceb2e6d9709_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
Errors
Reason
platform exec: image=C:\Users\Admin\AppData\Local\Temp\2026-11-06_fba01d909a31944795fbaceb2e6d9709_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
command="C:\Users\Admin\AppData\Local\Temp\2026-11-06_fba01d909a31944795fbaceb2e6d9709_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
wdir=C:\Users\Admin\AppData\Local\Temp
Payload error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.
General
- Target 2026-11-06_fba01d909a31944795fbaceb2e6d9709_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
- Size 1.4MB
- Sample261107-wpzdlszzew
- SHA256 1374c0b3cdab2c1f458b152c6ea422799c362cbb5e85a1778a7c438235e7a16b
- MD5 fba01d909a31944795fbaceb2e6d9709
- SHA1 ce9ad9b07148029ec5bb35718f8e7d6f5355179c
- SHA512 a0c2179ef7f8ece2c53a86f898642687a8ecb059b9f25f60643da78098c33044f164a13bd89d10f89ce9127f68dc5c2978de6fce2ff276a814d1caf42b795421
- SSDEEP 24576:aZYZnJ9j4lPDBBG01cvRtO1x8+KsPPJrj2zQwua:aZYF4VDn6M1dKKJrE3
- TLSH T1A265E126B6A110FDD05AC136C7165232F7B1B8470B64B6EF0390D3692E7BAE85F39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3404-0-0x00007FF7684B0000-0x00007FF768792000-memory.dmp upx behavioral2/memory/3404-1-0x00007FF7684B0000-0x00007FF768792000-memory.dmp upx