115d25ff4f1254b529fac9bca3a5680af5f2ca2f8210beeb8516326ea1ab738b

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 10:18

Target
2026-06-04_a3149f553a6cf8982b82622cb881a376_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Size 1.5MB
Sample260604-mcf7tsdv3j
SHA256 115d25ff4f1254b529fac9bca3a5680af5f2ca2f8210beeb8516326ea1ab738b
MD5 a3149f553a6cf8982b82622cb881a376
SHA1 7c62ac979826795e3810fb6368cc561b8cab19fc
SHA512 ab4d198ffe3aa1b00d9b670cbf3c0f08ed826ef3eb8607b22bec30224e88b56969147c149d7b52895e1a668cce1e9872a366a6ec0cc7e887a609faf4ed1d8143
SSDEEP 24576:WH3Gn+EjQQN6//m6t/E7Y0RgAiGN63q7Jkx:MJ/m6vrB3qq
TLSH
T18A756B07B28654BDC09BC07192479A67A939748A0F34ADDF03D44A793FA6BF02F3A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1576	svchost_netsvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1576	svchost_netsvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1576	svchost_netsvcs.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1576	812	2026-06-04_a3149f553a6cf8982b82622cb881a376_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-04_a3149f553a6cf8982b82622cb881a376_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_a3149f553a6cf8982b82622cb881a376_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\svchost_netsvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost_netsvcs.exe" --morphed
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1576

svchost_netsvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost_netsvcs.exe
Size 1.5MB
SHA256 115d25ff4f1254b529fac9bca3a5680af5f2ca2f8210beeb8516326ea1ab738b
MD5 a3149f553a6cf8982b82622cb881a376
SHA1 7c62ac979826795e3810fb6368cc561b8cab19fc
SHA512 ab4d198ffe3aa1b00d9b670cbf3c0f08ed826ef3eb8607b22bec30224e88b56969147c149d7b52895e1a668cce1e9872a366a6ec0cc7e887a609faf4ed1d8143
SSDEEP 24576:WH3Gn+EjQQN6//m6t/E7Y0RgAiGN63q7Jkx:MJ/m6vrB3qq
TLSH
T18A756B07B28654BDC09BC07192479A67A939748A0F34ADDF03D44A793FA6BF02F3A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/812-0-0x00007FF6FC780000-0x00007FF6FC905000-memory.dmp

Download

memory/1576-5-0x00007FF671870000-0x00007FF6719F5000-memory.dmp

Download