79f6048201726099c59f673d86a2ac0c382938d94dd3fe4d17c2f3f1bd0c5186

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 14:24

Target
2026-07-07_70b788ba60bee1bce67ea215c6fdac47_cobalt-strike_icedid_satacom.exe
Size 4.9MB
Sample260707-rq7ddsft4x
SHA256 79f6048201726099c59f673d86a2ac0c382938d94dd3fe4d17c2f3f1bd0c5186
MD5 70b788ba60bee1bce67ea215c6fdac47
SHA1 9eaed68b0a5e4ee0dc41464245a846ad1f685041
SHA512 097ff78d0c3139b9ffb4b2dfdbc94412d2bd562beba9ea2a3dbe2047596a0b78434868064dfd974eaaa3009b8fe0887b08537f636b069af3b7a8a97209255533
SSDEEP 98304:0KrodtFORsywRrIgnxES2l5IJTUTpTpwOY59k:0NFoTA9nxSl5IJT8Ym
TLSH
T12336332AF0E211E2F7974276C42A2535E3B1F66D4BE49FEF7325C2198C432C88C71A55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x001400000002431b-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x001400000002431b-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x001400000002431b-2.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 1 IoCs

pid	Process
2828	crp2640.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2828	548	2026-07-07_70b788ba60bee1bce67ea215c6fdac47_cobalt-strike_icedid_satacom.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-07_70b788ba60bee1bce67ea215c6fdac47_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_70b788ba60bee1bce67ea215c6fdac47_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\crp2640.exe
  "C:\Users\Admin\AppData\Local\Temp\crp2640.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

crp2640.exe

Path C:\Users\Admin\AppData\Local\Temp\crp2640.exe
Size 5.1MB
SHA256 4aa74e5cfd40d00d29582208bf1fd1b9cf16ecaa255d604e2bcbc64df80a6330
MD5 345b907c1ba7b31dc6ac21db163c9cc0
SHA1 38afe06379c0380785552f0b11739964ac552825
SHA512 9cdcc80724ae0ddf325616dd417b4c98a9a38515d2ef2b7a42cd92c1b720ee73f3681e046976415fc6bef084d1958e27bd75b6eaac6a8b7def83f6e86d763ef3
SSDEEP 98304:RFtkP/uIHF/LdVSTYwdvKOYdn5ehEtScSECW5X:+HH9fSTYws5
TLSH
T144361A43A5D70CE9CED7A77895C7A232A734FD758B295F2B9644C6302D23AC06E1EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download