738135060ba96add8da34e863b68e7e9a03d7c152c5bdf0cd8235f199dd78bc3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:38

Target
2026-07-11_4d51d8870117cba3179554fdc65350c4_cobalt-strike_icedid_satacom_stealc.exe
Size 381KB
Sample260711-e9r2ladz6w
SHA256 738135060ba96add8da34e863b68e7e9a03d7c152c5bdf0cd8235f199dd78bc3
MD5 4d51d8870117cba3179554fdc65350c4
SHA1 fa2617442c89b03605e28496a1439c03be2a3db7
SHA512 528dfa0270ee14bca084be122ba08da5be65bfe0267cc0554f824f32909728751dc13662cd7c7c61f863871be905f7c2e60e7ba3a923d7cda983b32ea40c73bc
SSDEEP 6144:jnW16bU01Fst+gzp+q5C6eAMBWY0I8SGPhAtgDPo7eHWLDfZ5QHT1hHXVO8qFuaz:jnZ3FssUCFfBRZGG2U0WLrZ2HhxXVx8D
TLSH
T1C184F157B3A530F8E27B8539C8921656E772B87A53219BEF0360865A1F236D0DC3CB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Executes dropped EXE 1 IoCs

pid	Process
1984	svc385C.tmp.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3544	timeout.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1984	4784	2026-07-11_4d51d8870117cba3179554fdc65350c4_cobalt-strike_icedid_satacom_stealc.exe	86
PID 4784 wrote to memory of 5988	4784	2026-07-11_4d51d8870117cba3179554fdc65350c4_cobalt-strike_icedid_satacom_stealc.exe	87
PID 5988 wrote to memory of 4864	5988	cmd.exe	89
PID 4864 wrote to memory of 3544	4864	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d51d8870117cba3179554fdc65350c4_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_4d51d8870117cba3179554fdc65350c4_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\svc385C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\svc385C.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c timeout /t 5 /nobreak >nul & del "C:\Users\Admin\AppData\Local\Temp\svc385C.tmp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\cmd.exe
    cmd.exe /c timeout /t 5 /nobreak
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3544

svc385C.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\svc385C.tmp.exe
Size 253KB
SHA256 d0da81c2cb416ec690015e66aefcda5e08c5985742fd7e556bd1fbf21cf4e2c5
MD5 4fe2242c1e05651d2c54ddd391fa9393
SHA1 499232829e9b5cc4df68cc428fc6c36f24fed1cd
SHA512 9215dec7fac8e7d652b16da098379e30a3d3d06bce5e086ecca1f5c09640b614a5cdc91c6c7b8a7aad42a3c55ae930eaeab449bc262bce915596a2e68a529620
SSDEEP 3072:sTT542Eg5nGZgDxkU3p7s1ROggttCcGPTj2hNmOlQ6TvN10lAsAEYQO+iDLLT:ZqG6DiU57s/Ox27gbTei3
TLSH
T18C447D1977A41CFDED7BC67DC9520906EB72BC4647A0E68F13A00AA61F236909E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download