e57da9282ba068dbf38c9a73f52fe23cd9a5013eba202dc8246fc8b493f94dbd

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 01:23

Target
2026-07-31_94b45bef4c3fd3c6f41ab3932a8d6154_cobalt-strike_icedid.exe
Size 242KB
Sample260731-br59qaaf35
SHA256 e57da9282ba068dbf38c9a73f52fe23cd9a5013eba202dc8246fc8b493f94dbd
MD5 94b45bef4c3fd3c6f41ab3932a8d6154
SHA1 fb3e7d39d995ea7fb9ef7779fa691518f9ac5392
SHA512 e224dfa662e036cddbf7cae11763ab62c69e20450a00dafe6256974850aeafe3c7448ecc0c53698d955f6bb7f02d9c658e40d83f94c074fa6b0c7c1d93e9b369
SSDEEP 3072:1sWLDHsVr8qWNEFMArliwD+gBvt7fbUSc3XYgj30oFHnmWTeI26EQxm5+Arr3A:rnHsVr6ronDXAhd/nmWTPkQkH8
TLSH
T1B3347B563F9023E9E5AA473DB5111E4597257839C2A0D3AF436C00E23E326B3EDE9BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3628	hhjakniuzp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3628	2600	2026-07-31_94b45bef4c3fd3c6f41ab3932a8d6154_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_94b45bef4c3fd3c6f41ab3932a8d6154_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_94b45bef4c3fd3c6f41ab3932a8d6154_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Public\dbybk988ekj\hhjakniuzp.exe
  "C:\Users\Public\dbybk988ekj\hhjakniuzp.exe"
  2⤵
  - Executes dropped EXE
  PID:3628

hhjakniuzp.exe

Path C:\Users\Public\dbybk988ekj\hhjakniuzp.exe
Size 118KB
SHA256 43fc2db5251bff122b55d1529e74007bb7b4d3278a56691951b9c3ea2f580084
MD5 d5df89770f13445735c70d7c7d2a0100
SHA1 f902d52b7818ce81745695d9ce2d7f48f39d3373
SHA512 17ab93fd97224352c9257e2bae8c5e36610f8b1cbafa2f856806af03a8c2d9750d9588bfb3a7ba1c630d4a5da313ae228c2f74335e197a20df8f90cb7223b7f0
SSDEEP 3072:sdxXL+dW/mhLvitAK7bpBec9cXPPqATj:wXagipK7nGJ
TLSH
T11CC35B5BA3A530F8F4778638C4920A46E776B83617609FEF07A446572F236D18D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kotmkhtjk.mj

Path C:\Users\Public\dbybk988ekj\kotmkhtjk.mj
Size 6KB
SHA256 6f15bba0493c765690faadf24f0c34f5f9c20873409db9e65c20fff3e7373bca
MD5 85a5d0834a201be967b9aa885c45795e
SHA1 e0dd318ef930ba6a63d0fcd60235da307572f629
SHA512 c488519ce2b592750bc732a6edfca7bec2973e2bb89221b50522ab69acf28b293b8385e0dda43a9d74e8ed66b8ad1c14cc7f28964dae17cd444d4a23aefeee4f
SSDEEP 192:Tbu569i1mgWQskldcmQHTSuKan8aZJbVdjeKB1ioNv:m569i1KbB/nVPVde65Nv
TLSH
T126D19E80668F9588D41CF21D03ED5EE812735CD0BDBE8722E89F4BA510756DAE2CBA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3628-6-0x000001807C090000-0x000001807C092000-memory.dmp

Download

memory/3628-8-0x000001807C090000-0x000001807C092000-memory.dmp

Download