c9a040a27f77146684382ca49f614ee458d0a56092d9344f4281b3eb9582170e

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:40

Target
2026-06-30_628b2967c90930e9a0490eae58ef30d7_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 564KB
Sample260701-falafagv2s
SHA256 c9a040a27f77146684382ca49f614ee458d0a56092d9344f4281b3eb9582170e
MD5 628b2967c90930e9a0490eae58ef30d7
SHA1 ea0858b5a434492a79f9d0c686d4705d777451f6
SHA512 f7a4bd19c204172006d329f6dd651d9a18798ca2588aa86ff81e915672801b8337b61e0b7ec0042c33c59db1aa134b6749d7dff68bd0849d1ac71b5b55c0f0fe
SSDEEP 12288:CBm6koFiG4OUAIdyOFB7GjCUGF+abP3LZh:C+oFFZUyO/Gj6rT3X
TLSH
T1E5C48E69B29402F8D0ABC978C9834407E673784603725AEB43D18AA65F275F19F3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2908	3156	2026-06-30_628b2967c90930e9a0490eae58ef30d7_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 2908 wrote to memory of 992	2908	cmd.exe	90
PID 3156 wrote to memory of 4988	3156	2026-06-30_628b2967c90930e9a0490eae58ef30d7_cobalt-strike_icedid_njrat_satacom_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-30_628b2967c90930e9a0490eae58ef30d7_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_628b2967c90930e9a0490eae58ef30d7_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=132 lines=44 >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\mode.com
    mode con: cols=132 lines=44
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4988