7dd92ced1986f4ba672e66cc0020c576e5b67e25c18038dbec5a1b9ecd99faca

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:31

Target
2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe
Size 2.4MB
Sample260522-cz55csfv91
SHA256 7dd92ced1986f4ba672e66cc0020c576e5b67e25c18038dbec5a1b9ecd99faca
MD5 252974a2f7445e509c16cc9f202cec2a
SHA1 74bbc4310f3533bcb6ecbda7815163ac31cc6cc7
SHA512 a3fded4993452bb9fd09ca5d19526031506b8b6a00ffcdfe7595027e9c8f2219c5864ae527a3bfd386f99150e88f54acfd77cfab80ee36db8cac66ea7275b913
SSDEEP 49152:6/wCRoTBT/V76mMV0atHR/4b04a1xzYsjGpmsjF5iHkuHc3slLNA2d:YfR876mkpy3a1xzYsjGplj7iP8oD
TLSH
T10DB52323B3E120EBD6934574492A1356E336BCB60BA186FF43A541295E17CD09C39FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2960 created 5064	2960	2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe	81

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2768	2960	2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\winver.exe
  C:\Windows\system32\winver.exe
  2⤵
  PID:3088
- C:\Windows\system32\ComputerDefaults.exe
  C:\Windows\system32\ComputerDefaults.exe
  2⤵
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe" --payload
    3⤵
    PID:2768