de75b08c1b5633a47e6989dc83c9108cf1f3ddf4cc3b63832b6f84efe01d4ee6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 23:25

Target
2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe
Size 702KB
Sample260508-3emqdsfv8x
SHA256 de75b08c1b5633a47e6989dc83c9108cf1f3ddf4cc3b63832b6f84efe01d4ee6
MD5 8ac35c025f836efc3b809eebe9213ad5
SHA1 2c9868656891c3dfaee01a8e89cb9a75a17e546f
SHA512 32976ebf520dc2c22112d51ac626f8d89afd009607be23637e527aad8fac385f25af67a9434829cfca1815247a199d8c2911ba56fde0acb2bc715af57a17d88d
SSDEEP 12288:nulgNBiyZuzM4KQ8zxWobMuX5BEC7iBjykm2NyQmQ+aDQIghttSzlQ20BvQ2cZIS:Zuw5rbRJBb7iBe2NyQL+atUMzn0Bv57
TLSH
T1FBE40259BAA555F8E6B7D675C8110601EEB2FC4347A0E64F03E04A978F237909F3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5636	4772	2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:5636

phantom_log.txt

Path C:\Users\Public\phantom_log.txt
Size 307B
SHA256 71cec2eb9fc30bd12ba282f36dbf815082f34e59c9e888bd8037505da72410bb
MD5 808ccf4c73ac80e2799251f45d8327f7
SHA1 cfe0a7e082dd74b5ea8930ca7daa5edf24e52555
SHA512 83268d49c94bd0fe6a8ed969e831b30380deeca62e5642e455c87dcda5fe351ca2edb0acdf0718d9b9f2749d378b42b6895d101cc24fe4c181c7a8fb895c9f1d
TLSH
T117E02B603A540026469D1447E481CA76A9669E467D69CABD241D825CFD133CB660D834
MD5 SHA1 SHA512 TLSH

Submit Download