87b82c7b6199d45b3a09431b8e35561bc0643b69ae1338c2e330fcc606da758f

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 08:30

Target
2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe
Size 2.8MB
Sample260705-kecajsbs21
SHA256 87b82c7b6199d45b3a09431b8e35561bc0643b69ae1338c2e330fcc606da758f
MD5 748911d4de481478d4bc344a8c172fdc
SHA1 6aa9b36d4fd328e267f731ac783fe219da15ea79
SHA512 6d43b0a1b054834ae6b47afc7a8f5b7eea6c49ec6e6f8b1eefcac6d404f313f343e64e50defc9720bcc95be37746cade51d6c22212c39342a8400d4481b58ade
SSDEEP 49152:GQbU/euX/Hd5MiZmBEpYqfDbv53Ac8uZfZbgLs6dsFs28v6xfPQ:GQbU2uPdrBbvp78uIsdTQ6hPQ
TLSH
T19CD52317A2E601F9E2A7D138CD425515EA72FC056B75F5DF13980A960F27BE08E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 5692	5428	2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe	89
PID 5428 wrote to memory of 5692	5428	2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe	89
PID 5428 wrote to memory of 2040	5428	2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe	92
PID 5428 wrote to memory of 2040	5428	2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_748911d4de481478d4bc344a8c172fdc_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1948