51d9d41dbcc182ebe966473a3bdadcf69867833f484ed0f3d3a295e96923601a

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:09

Target
2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe
Size 3.5MB
Sample260705-l6892abx4t
SHA256 51d9d41dbcc182ebe966473a3bdadcf69867833f484ed0f3d3a295e96923601a
MD5 a2de74833ede0cc2d900bbac5edb71b2
SHA1 7f5570fd52a3411d72a060edd2d96145ac10ef25
SHA512 6613dda993ea81cdaf7aa5a23fdbddfee9c070485bb91700428583d81dacecebf87aa3e4601114bdbf2700133a3868f292ca5231ca02a3dfdfb1c3fb1858cd06
SSDEEP 98304:2UQKM5SVJs8+sC79db9822J51Q0HyRg3+WP4zSPao3:2TR9zdG22xQ0Hyo9USPF
TLSH
T1E0063393B06A39FBE962C93C911543258B53B8309327A6CF0B5441B56FA61F2CE35FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/3724-0-0x00000278F8AF0000-0x00000278F9747000-memory.dmp	UPX

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3796 set thread context of 3724	3796	2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe	88

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3724-0-0x00000278F8AF0000-0x00000278F9747000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 3724	3796	2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe	88
PID 3796 wrote to memory of 3724	3796	2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe	88
PID 3796 wrote to memory of 3724	3796	2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe	88
PID 3796 wrote to memory of 3724	3796	2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_a2de74833ede0cc2d900bbac5edb71b2_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe"
  2⤵
  PID:3724