aef33b572ca9ab0896507f1861174d019b4f4287987f933353a2130f6b10cd93

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:56

Target
2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom.exe
Size 121KB
Sample260602-cc3eyscw4l
SHA256 aef33b572ca9ab0896507f1861174d019b4f4287987f933353a2130f6b10cd93
MD5 2e53df93ad71094041471f73d25d4f7b
SHA1 d82e53de8190cc95a015837fe4278694b786cdda
SHA512 0bfb4b363f7e9ad61dded10ef731c5920e9a0c8abf40b908e25179d5b7eb0e20744070f6475a2f86465b4327335af767a0a08d789fd4e67711d50e26b295ee08
SSDEEP 3072:XpKQDo5sdc6imbNf9zvsAVvd1rALfhsDj6XXXX/XXXXXXXXXXXXXXXXXXXXXXXXB:Ajsdjzvssldem6XXXX/XXXXXXXXXXXXB
TLSH
T183C37B57B3A130F8E5779239C5848A4AD3B6F83547B09BEF03A846951F132E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2524	tmpE455.tmp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2524	5112	2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\tmpE455.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmpE455.tmp.exe
  2⤵
  - Executes dropped EXE
  PID:2524

tmpE455.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpE455.tmp.exe
Size 5KB
SHA256 ecaa33aec25a96f15d89851ddb7524177404e4d21683608be2391950fde1a1b8
MD5 54b9463926fd4c0f8b25a4406ab977ab
SHA1 65e8a182fb2b892cc07692cdefb35bd2aefdf336
SHA512 c20df5cc8048c8f054bb3439c4c00b9256b9611a2a4da30b69956f913fcedea25fec4a8e84dc0a4fbb2d3e8536fa950cea739658e7169a5e5331d49c1aead078
SSDEEP 3:WlWUqt/vllnl+YZcFTS9gXeF+X32ZpAl4/l/i/FtldltllEPl5vxVlJ/llDtllFG:idqGVg3F+X32Q6lwR1
TLSH
T1B1B1120682F888F2C00C03B80647C98462A4642497E093431FA0242FBC211AD88FAE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2524-3-0x0000000140000000-0x0000000140002000-memory.dmp

Download