a0499bcc90626a70877c18de1be7d2e842b71641c9fe07c9726f7699c4ec9766

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:01

Target
2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 301KB
Sample260806-sebysadq5w
SHA256 a0499bcc90626a70877c18de1be7d2e842b71641c9fe07c9726f7699c4ec9766
MD5 b16b5d975764388e694f167872600ccf
SHA1 218d9e5d32acc1138d12419716a3f268c7094b09
SHA512 e7373362bf6e09e40a1aa8a36528ce183f40aa90253e6c537a267ebacf55a8806714c0a4a84f6b72345e969da4281e5b5a389a7ddb112b744e7a732414ad365a
SSDEEP 6144:thJJWpJyGGXZI+PR/vMrL2q+EwlqnN9U7CeaVR/1xcmP9JW52CD:U1Y/eiwNGuemPKmP9JWc0
TLSH
T1EF648D15AA6508EDDA77D17CC9965D02FA323C4A0770EEEF079049A71F23AE09D3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 5648	2884	2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe	90

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5648	2884	2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 2884 wrote to memory of 5648	2884	2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b16b5d975764388e694f167872600ccf_cobalt-strike_icedid_njrat_satacom_stealc.exe" --k c9affffff9abfdacfcf0acf0f8faf0a8f0fbf8adfbf9fbaaabfcadf1fbacadf9fff0acfaafaffcabafacadadfef0fff1f9feabfbaafbaafeadadabacaafef8acf8 --h c9feaaadfefcfafbfdfbfaaaa8aba8fffdfdfbfdf8affdfdaafcabf0a8aafbfdf1fbaffaaffffafafcf9abf8adf0f8fef0aff1fafcabaaf0aff1fefaa8faffafaa
  2⤵
  PID:5648

memory/5648-1-0x0000000140000000-0x0000000140416000-memory.dmp

Download