ebbb481bdbd7808612351df31a7c744ccc95267bb67bdccccdbcb56dd1c9b6b3

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:42

Target
2026-07-10_500fcbb79c4277290f4d9d68fea19837_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.0MB
Sample260710-2m69bsdv3m
SHA256 ebbb481bdbd7808612351df31a7c744ccc95267bb67bdccccdbcb56dd1c9b6b3
MD5 500fcbb79c4277290f4d9d68fea19837
SHA1 8e0a05014881730a2bf2fec8f13b7e2a066db45e
SHA512 1df0150391d82e666e12e9a2e8fb068263a20c645b890660de161a689327fa9e1fcf210b7c428263cbcc09ca319eb6adfd62bb1420dbccd839b1481e2d201ffd
SSDEEP 24576:V1khs93aw9V20GvwJn7HdF+jxft6MS68aLDkT+udp/:VP3aw9VEvcn79F+jxft6N68aLDkKyp
TLSH
T1E825BF05AACC52A4EC6B947CC5084E0BEFA0B9210B10DED3C7385786EF6B3D15B7B695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3824	4548	2026-07-10_500fcbb79c4277290f4d9d68fea19837_cobalt-strike_icedid_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-10_500fcbb79c4277290f4d9d68fea19837_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_500fcbb79c4277290f4d9d68fea19837_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3824