52b41db4b8b7418746c1da4dfd3921d91ba344680106c6fca98526be7cf4be7b

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:15

Target
2026-07-11_b5c29a0c1e7d741d1e8a94f688fad9b8_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
Size 333KB
Sample260711-evjrnsdw6t
SHA256 52b41db4b8b7418746c1da4dfd3921d91ba344680106c6fca98526be7cf4be7b
MD5 b5c29a0c1e7d741d1e8a94f688fad9b8
SHA1 f22ff27501a4ec51b88e00cbd85316261069947d
SHA512 421bfb36a5e9972269ac0a3f24a9d637c949b80dab3ef3c46306ef138b0935fdede3a9a086b1f7bf13b2ac2be53635bf9a2ac8945d4be5a0c275e1c728d7e5ce
SSDEEP 6144:rgGysP3LNno0Q51d/w3xywyFT+mUC67KbeT:MN0iB6ywq+mUCW
TLSH
T1E4749E15F7A918FAD167C178CA424545EE72BC564B60AACF33904BAA2F336E05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 5860	3108	2026-07-11_b5c29a0c1e7d741d1e8a94f688fad9b8_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_b5c29a0c1e7d741d1e8a94f688fad9b8_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_b5c29a0c1e7d741d1e8a94f688fad9b8_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:5860