7d46b002ba2d2bce37f2046ae310a7e3c51236c9cb5eb1f9995af4221fa7f2fb

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 08:39

Target
2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe
Size 1.4MB
Sample260705-kklfeabs5y
SHA256 7d46b002ba2d2bce37f2046ae310a7e3c51236c9cb5eb1f9995af4221fa7f2fb
MD5 0f893681b3db6f611de1d101d8d1de2a
SHA1 43b99dc423447923efe5d5872a0978733421b2a0
SHA512 b8a65f351a6b2585b56e0f4a5e0b23f7119e3d1769746ec0fc30725e0216189f26cd2a709f7005ddef8c9cf7b6bf06057c6b59384350e09c04f7f4203cec5dc5
SSDEEP 24576:pQZK1hNhD4PSaeuf5moyWSMPkqHN/KqMiZmKXmo:6QbU/euX/Hd5MiZmBo
TLSH
T115651207A7A501F9E1B7C178CD521906EB72FC065B75B9DF17940A920F23AE09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 3328	3996	2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe	89
PID 3996 wrote to memory of 3328	3996	2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe	89
PID 3996 wrote to memory of 704	3996	2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe	92
PID 3996 wrote to memory of 704	3996	2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_0f893681b3db6f611de1d101d8d1de2a_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288