e4d1d8ac780a0cd7e20221be2b1ee5d20ed27d0d8e7e287817ed3c4fbf0cfa33

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 09:46

Target
2026-07-03_d627bd760d2cd14d81524d7cbc2f4590_cobalt-strike_icedid_stealc.exe
Size 428KB
Sample260703-lr4e8sbw9j
SHA256 e4d1d8ac780a0cd7e20221be2b1ee5d20ed27d0d8e7e287817ed3c4fbf0cfa33
MD5 d627bd760d2cd14d81524d7cbc2f4590
SHA1 9c9cda5939018f11988defcfed3cd36e17b51757
SHA512 4903ee22991b3025a74dc6d3bd446f6e56307798f50e0c84074abed05868fbabfceee3917f90af810e62cde9a1f90fffde427b667ff07b5b6bae4bfd232d868b
SSDEEP 3072:99gds1xBXBrA28pYh1PjOmvglrjbUqeAOZnJphRKTh5mmmmIyuvSn:99ss1xBxs28pYf7BUynZL3
TLSH
T1A8943B976155BBEAD136CE7C88714902EF31BC228751669F13403BE90E33AD74E3AE52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 3256	3520	2026-07-03_d627bd760d2cd14d81524d7cbc2f4590_cobalt-strike_icedid_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_d627bd760d2cd14d81524d7cbc2f4590_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_d627bd760d2cd14d81524d7cbc2f4590_cobalt-strike_icedid_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java.exe -cp C:\Users\Admin\AppData\Local\Temp\ira.jar V
  2⤵
  PID:3256

memory/3256-2-0x000002052B830000-0x000002052BAA0000-memory.dmp

Download

memory/3256-11-0x0000020529E50000-0x0000020529E51000-memory.dmp

Download

memory/3256-12-0x000002052B830000-0x000002052BAA0000-memory.dmp

Download