7273cfec638c24a09c5179ee25c5b69bcf9ec53c2765360cdd1fa07237996c19

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 04:26

Target
2026-07-03_532d0b46b1483847f65e6a45eb92d21f_cobalt-strike_icedid_satacom.exe
Size 5.2MB
Sample260703-e2sm6abt8w
SHA256 7273cfec638c24a09c5179ee25c5b69bcf9ec53c2765360cdd1fa07237996c19
MD5 532d0b46b1483847f65e6a45eb92d21f
SHA1 dda3a74437c3af3def91bd3916bce5d456070cc3
SHA512 04cc614781497744400ac1603de0692a96fc0e6043bda067dfd7b92ed638ddbd846aa56b9c813198fe3e2b2b36477f3dbf8affc62ec1bd716de6dd44f6860c67
SSDEEP 98304:c3PBXuCZs7iZDUt3eq9I63ODTmUcMXCEgJVqMol21eySTRzT14zvFgKKK4Wzk0j9:cACW7iLq9I63CnXC/JokoyAR4zNJR4WJ
TLSH
T12846332BAEA4F4D8CA64C13519A51341FBB33C3297546AEF0325DA7A2EE31C04E75F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0014000000024368-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0014000000024368-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x0014000000024368-2.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 1 IoCs

pid	Process
3332	pkg3747.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3332	3244	2026-07-03_532d0b46b1483847f65e6a45eb92d21f_cobalt-strike_icedid_satacom.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-03_532d0b46b1483847f65e6a45eb92d21f_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_532d0b46b1483847f65e6a45eb92d21f_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\pkg3747.tmp
  "C:\Users\Admin\AppData\Local\Temp\pkg3747.tmp"
  2⤵
  - Executes dropped EXE
  PID:3332

pkg3747.tmp

Path C:\Users\Admin\AppData\Local\Temp\pkg3747.tmp
Size 5.1MB
SHA256 4aa74e5cfd40d00d29582208bf1fd1b9cf16ecaa255d604e2bcbc64df80a6330
MD5 345b907c1ba7b31dc6ac21db163c9cc0
SHA1 38afe06379c0380785552f0b11739964ac552825
SHA512 9cdcc80724ae0ddf325616dd417b4c98a9a38515d2ef2b7a42cd92c1b720ee73f3681e046976415fc6bef084d1958e27bd75b6eaac6a8b7def83f6e86d763ef3
SSDEEP 98304:RFtkP/uIHF/LdVSTYwdvKOYdn5ehEtScSECW5X:+HH9fSTYws5
TLSH
T144361A43A5D70CE9CED7A77895C7A232A734FD758B295F2B9644C6302D23AC06E1EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download