483d0e0e34ecfff38b1c3ace97b9c045aae312623c9c7e2c8ce72b9dcadd5fcb

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:05

Target
2026-07-23_cee6a000f5dce0e41602ff9547ca4487_cobalt-strike_icedid_satacom.exe
Size 1.1MB
Sample260723-bfl2pstxbt
SHA256 483d0e0e34ecfff38b1c3ace97b9c045aae312623c9c7e2c8ce72b9dcadd5fcb
MD5 cee6a000f5dce0e41602ff9547ca4487
SHA1 1c0ea3a9a0e32f7d6bcc3c6af7c212945e176353
SHA512 4d90127db1e578e908656235cec28a3cbb12de2689f6a8a09dbd4ef755bd1f57d4830584bb734162f7d5b2b916b9e396e37786823447edd9fe1f7addf75b16b9
SSDEEP 24576:zjNAUPZTDNSXUHR4kH4HtBc7EMuPhH5UaGvUCBkPxu60DT4k4PR/hEBjGotqQWlI:z5AUPZTDNSXUHRzHcBc7EMuPJSaGvUCN
TLSH
T10E451A272615C579FC8C4E7CA305AA4193BC83778711DDC9F2AC0B9B796B3C6262C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 4884	6004	2026-07-23_cee6a000f5dce0e41602ff9547ca4487_cobalt-strike_icedid_satacom.exe	89
PID 6004 wrote to memory of 4884	6004	2026-07-23_cee6a000f5dce0e41602ff9547ca4487_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_cee6a000f5dce0e41602ff9547ca4487_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_cee6a000f5dce0e41602ff9547ca4487_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe"
  2⤵
  PID:4884

memory/4884-3-0x000001B626C50000-0x000001B626C68000-memory.dmp

Download

memory/4884-4-0x000001B626E50000-0x000001B626E6F000-memory.dmp

Download

memory/4884-5-0x000001B626E50000-0x000001B626E6F000-memory.dmp

Download

memory/6004-1-0x00007FFBEDFC0000-0x00007FFBEE087000-memory.dmp

Download

memory/6004-0-0x00007FFBEEA40000-0x00007FFBEECA3000-memory.dmp

Download