4167aa9eaf88544e30f46b1c2e4d19c052ab09db8d028b4846f62fd99bd6c43e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:58

Target
2026-08-06_03c274d8f9f36c2f3d58fb33fd983b47_cobalt-strike_icedid_stealc.exe
Size 119KB
Sample260806-q92ftaxtfy
SHA256 4167aa9eaf88544e30f46b1c2e4d19c052ab09db8d028b4846f62fd99bd6c43e
MD5 03c274d8f9f36c2f3d58fb33fd983b47
SHA1 adcd16e9cc7f8325c59fa4a073e45691d2d0a221
SHA512 205da630634240828d6637890ca5ee9f39f8da63cbb44c959d0bfaad263e49df8cdd505b153b6b33a981cc4189abd848a1281c9f854cf1a98fdb2e7a28e35495
SSDEEP 3072:6IY0STIwTMKKSbZO5mlQOoJt2mHx/SSFqPSbD:CzT9nbUXJtJN+6
TLSH
T126C3384BB2AD70F8E0B69238D4521A0AE772BC7107749BEF43A0475A1F636E05D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4092	4680	2026-08-06_03c274d8f9f36c2f3d58fb33fd983b47_cobalt-strike_icedid_stealc.exe	88
PID 4092 wrote to memory of 1712	4092	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-06_03c274d8f9f36c2f3d58fb33fd983b47_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_03c274d8f9f36c2f3d58fb33fd983b47_cobalt-strike_icedid_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1712