9a4bdad3cd662b426f91d8e18d17bf548bac85e7d88c9ff54b1a649198fc70c9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 08:11

Target
2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe
Size 1.4MB
Sample260704-j3pecacz4s
SHA256 9a4bdad3cd662b426f91d8e18d17bf548bac85e7d88c9ff54b1a649198fc70c9
MD5 bdc66b3de4af3b52ddd6ab751d2403bc
SHA1 162cfccb367593a3d12c8116adf43417d1bd19db
SHA512 4d46df263981cab154648461cda136c83aa36ae9e9e59a8bafc706f5542c3dfea05feeee289616b86e2b411aeace997833ac69567eb2e7c6ec079853c523cd50
SSDEEP 24576:NQZK1hNhD4PSaeuf5moyWSMPkqHN/KqMiZmKXm:GQbU/euX/Hd5MiZmB
TLSH
T19D650207A7A501F9E1B7C178CD521906EB72FC065B75B9DF17940A920F23AE09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4376	4876	2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4876 wrote to memory of 4376	4876	2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4876 wrote to memory of 2428	4876	2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe	92
PID 4876 wrote to memory of 2428	4876	2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_bdc66b3de4af3b52ddd6ab751d2403bc_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3876