450d56b2bc391a1a822d086dfa52be44015915f542087c27360d87a097eaf5c8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:36

Target
2026-08-04_ab8d92fd0d62be36b793eca2188a0cba_cobalt-strike_icedid.exe
Size 333KB
Sample260804-ryptbaztev
SHA256 450d56b2bc391a1a822d086dfa52be44015915f542087c27360d87a097eaf5c8
MD5 ab8d92fd0d62be36b793eca2188a0cba
SHA1 1b3e3f2bdee314528ca3fc856f5b3f3265121db1
SHA512 6746a6f873ffb634d63a4da53d6ab44e85dbe66f642a951b01db0856b173f4f06623c1dde367eb6634410191cef71b6c8835f3be2531803f08a4563024fcd9d7
SSDEEP 6144:DMAvoY7HwV8ADbJajwdklM4HCtFsIqZcB8:DMOQeAha4klM1tFlScB8
TLSH
T11574AD33A3D3ACF8E5E20638848D9E079764F86117533BAFF2D096461E2F59C4E29B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
848	qznbufqj.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 848	3188	2026-08-04_ab8d92fd0d62be36b793eca2188a0cba_cobalt-strike_icedid.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ab8d92fd0d62be36b793eca2188a0cba_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ab8d92fd0d62be36b793eca2188a0cba_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Public\kb2bkbuecy9\qznbufqj.exe
  "C:\Users\Public\kb2bkbuecy9\qznbufqj.exe"
  2⤵
  - Executes dropped EXE
  PID:848

qznbufqj.exe

Path C:\Users\Public\kb2bkbuecy9\qznbufqj.exe
Size 150KB
SHA256 bbfe18d48a9ec74cade0668ec892c34e25f62328e1b8d361cb4b2fb83a35af02
MD5 bdc126065df11715ebd42efcf662e93b
SHA1 b5bdc1e069a76ee03f80ff01a119120e9fdc23b4
SHA512 f8201052054f109566da68b7db8f919d8039d19db47c7f586f64c08266c3d4d14949b650c78d428d23ee8e6dff27c5f7723b4e748ba96b46e8677b0cf584c151
SSDEEP 3072:idxXL+dW/mhLvitAK7bpBe/9cXCPqUTCHSA9p+IiyPEW+gS6cH:OXagipK7ne9ewIOVH
TLSH
T196E37C47B395B1F8E0B6867980510AB9D772BC3117616FEF07A4769A1E232E04D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

veaqzajpb.mj

Path C:\Users\Public\kb2bkbuecy9\veaqzajpb.mj
Size 6KB
SHA256 0bd50d1de5a2279ccbe78cc8e2bbd0d704cbaad6ffdf1fa7b3dd904c113b96d2
MD5 b3eef1e6371e3ac7505e469346434f2b
SHA1 bbdaef2e27bfe5c1de619f5300d0451533367852
SHA512 037665c9329872644e3c1fb304c136a62d6d0c66f522ce332f8e96de86814ea4d2db98b5efe1d9ba04135ade13bac7109dbd8348c8819f41543dbb1ae178ce69
SSDEEP 192:bdvu3r/tXIxdLI6Yh8Tl1tzDLwhCJbzJP+JJ:o7GdLXYhUZzXwhCJVgJ
TLSH
T110D18DD1454540FF8D388A10B80D2B8CDB2EE049D82A5B9F5FB139F4A175427A2766AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-6-0x00000234E9590000-0x00000234E9592000-memory.dmp

Download

memory/848-8-0x00000234E9590000-0x00000234E9592000-memory.dmp

Download