11b3cc49c235999021c9ea750da0280e8315120de6e88955c9943036247c559a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:25

Target
2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe
Size 114KB
Sample260804-njn2payemg
SHA256 11b3cc49c235999021c9ea750da0280e8315120de6e88955c9943036247c559a
MD5 6ecd6d60e1cf72f8a4df8828547e9db2
SHA1 a706521aa8f598ad2dfa24953ce4f2c5940ce210
SHA512 62d6c602c29e47841236828b33d9f7da7a5c9f69f9dc94b4ad37ea4875f7b20ea1a1990c4dcda41505b01e7b2b328ded6e7c66c93c212fd15d61c1c266927678
SSDEEP 3072:kaQEe6Wk289p2jpEi98Su/DwxXIAeUL5ZJ:VeTk23Wi9PlxXp
TLSH
T1BEB35B5B66F530F8E577823988624A45E772F8720761AFEF03A4425A1F236D18D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3188	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3188	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1492	2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe
1492	2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe
1492	2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe
1492	2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3188	1492	2026-08-03_6ecd6d60e1cf72f8a4df8828547e9db2_cobalt-strike_icedid.exe	91
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92
PID 3188 wrote to memory of 2668	3188	rundll32.exe	92

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 ed07e2a8f890beb72c26942b2ef76199e725d3cd073e5540a96e3281e34744f6
MD5 0bb59d5b3b02107adebb69f4f8179788
SHA1 67f8b5bb969f96ea8587f7759ee7906461eb6aac
SHA512 97bebfb7e4317780cba4f36942a360e9f07ef7d0a0fa10732a26abffa99105092b9711816b8b53ca1c9c633c6e467f7a8fe6607575335ae6d2b4d6bbf83e351b
TLSH
T14E41C5E52B1C7464FFC28F848978CB322D78F0E0A544656539FA84E2308ABE59D1B8DC
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 27327007cdc2fd19e14c5b648f85880afba08ce47dccab6dc8573c251d5aa442
MD5 7ed329a1c63f6e47cda1d3b8a2a23d5c
SHA1 5608800c3cd8d82ffd4914493e9cbd8f03cff521
SHA512 f6d70e1d427e239a52ef2e8118f271fe28aece2f3ee79d0771f4ec8c7b0db6f8b9b42d4be27b0fcced9feb36277227893f003bf4bcafbf3e330561b3724d1131
TLSH
T1E041FAFB2B09789CFF45CF457AF8C9751E74402191840592BD77C8A210EDB843B0654D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 3f3eddd9a7c3d1027fe25e6eae2ce80ef322c7f1d7b2b67b2a67ecdfef2c15cb
MD5 e64664795067e67d429615eee0e19952
SHA1 2e75dbab3637c97538a7621348b36865d4d4cccd
SHA512 ce4cd65ee9cfd0a3c750b30f8664f440c4a6b0c43ae0dab43b88c95d289ce63fe0c6ac6f991239eeca969ee8b51b6244e992cb35175dafdfb0774b52fec9f58a
TLSH
T19BF068303DFF517AF437693987E531B0672AF2293401227D2BB113192A15E206D81A0A
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 d815f8f73637b6ffef2ce56c8cf1a9e22196fa9e4d9de671bb1d87a6da895b6d
MD5 b9d5b119c43d83a897ed60f5cc2d52a8
SHA1 079b71e7faff9a519ca8ff4bc80ef8759954128e
SHA512 31caae6f9ca6a1bafdc6d49c9ac0c358683d5b31c86483788bb05b9229b7bce5a35943cb46e6710a421b154ee1183fd0f1d949a8cd9fd9cf2ffaf8a325f283ee
TLSH
T1ACF02B3D2CBF125FF141EEB982C211D69973F13725152B686EA143082F47E41BE21D35
MD5 SHA1 SHA512 TLSH

Submit Download

svc_load.dll

Path C:\Users\Admin\AppData\Local\Temp\svc_load.dll
Size 110KB
SHA256 fa5b9758301998c9eabf11e46da160b9aecbdfcd0c441aa584468d03c2003515
MD5 cd43b660a3e10300f36b7025bbf33798
SHA1 ff1358bf2e8cedfbaa45e6d78d07dce5db60f4fd
SHA512 770577565801a9ba67d8d24886786d2e4dafee06da1c330c04ae9e12f87d1ffa0cd7543108061260d3020f0a0dcba72553c6578d7c90889392713f565400c232
SSDEEP 1536:ghHMi9B21FKMhwEznlBbbgx4ZTHMS8AfqbxHjmcRJ6JYw9jsWadL9dlaGFBxv9bp:gLx+9RBQx4BsHAfqhmcRJnQ+jgGFjvG
TLSH
T185B35A57A3A910BFE17B8278C5634A45D3B2B84607609FEF07A0426A1F637D19D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2668-13-0x000001AA4A280000-0x000001AA4A2A0000-memory.dmp

Download