7f65e6b5e5b9e37f69e8229636932d3e48f7a3eb549c9d464d0dec92defd8f8a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:35

Target
2026-07-31_05fb77e0affd12be71dd0f0af506571c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 281KB
Sample260731-d5v21san2w
SHA256 7f65e6b5e5b9e37f69e8229636932d3e48f7a3eb549c9d464d0dec92defd8f8a
MD5 05fb77e0affd12be71dd0f0af506571c
SHA1 ef5b2515cc0b16b785cf35c18e1b08a055a20799
SHA512 24f597689bff91b599fe405e24dc51a93212d6f10223fe40999210763caf21aca28f0cc9d7e16a5a0225a22d069b8522a91d24005852859cbfa6d567c3170736
SSDEEP 3072:eLxQFecnnIIVU4hz6IUVv5/ob3SdGwA02ehDz9LOiWj7jVxzdh8izhkdry5O58yz:P+IBoqS5A0/FSiCich2r/D2e
TLSH
T18E545B0AF7A914F6E9BBC13CC952550AF97278624360EBCB13914A971F237E49E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 252	4984	2026-07-31_05fb77e0affd12be71dd0f0af506571c_cobalt-strike_icedid_njrat_satacom_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_05fb77e0affd12be71dd0f0af506571c_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_05fb77e0affd12be71dd0f0af506571c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:252