8e849b0ff8762e47f942d28ccd51f016f56a222093dde047a0098b3831be6030

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:46

Target
2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe
Size 5.7MB
Sample260723-mt58aawcrc
SHA256 8e849b0ff8762e47f942d28ccd51f016f56a222093dde047a0098b3831be6030
MD5 d286f406ba9c0c47e12b051ce32dff0c
SHA1 7d054c62630f702bce0ee6241b5b73d9747d9a80
SHA512 4dc49beeee50a3abf8d4e7962f680daffd7ba5d15c45c81f841ea7ce9df2f25b30e08ce21ec0667fc8c47f2c6e97615a1ffbd292cfcd801da088016e9d4af0ec
SSDEEP 98304:DyGgMjjmgg6ajqDQ9Kf3IylL/ljsi9e1t3AQPUUoe:VgMfjcMQUwK19e1bUe
TLSH
T1C8565D2BC697009A7C71D7734D594B6095F4B30DA2B1303663CF92E20E24DAC6BD97AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2932	936	2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe	89
PID 936 wrote to memory of 2932	936	2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe	89
PID 936 wrote to memory of 2632	936	2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe	92
PID 936 wrote to memory of 2632	936	2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d286f406ba9c0c47e12b051ce32dff0c_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1352