59807a83ee7aeadef324094af23062cddf6a2525377a0dc69f1711b98168b095

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:15

Target
2026-08-08_851d6524f4cf328ce42da11d23e4fcd0_cobalt-strike_icedid_satacom_vidar.exe
Size 165KB
Sample260808-dr1eksssfs
SHA256 59807a83ee7aeadef324094af23062cddf6a2525377a0dc69f1711b98168b095
MD5 851d6524f4cf328ce42da11d23e4fcd0
SHA1 ec5448b295009a80590a08fa49b9e301b6e94fe2
SHA512 45aa8e71d1e16d7d2edecf78a30225e858d5c15bb1467b4fcda623c1ee4bd57a84de39d650be0145dedd480dd4f0c74cf00b396377245707cb2457e4123d72ab
SSDEEP 3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uollejh:ndr0I0c5XICuiNLnluOdohPol4
TLSH
T1AAF36B1BB3A634F9E1728135C8520646F732787503719B7F03A4877A1E676A1AE3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2960	vahbsdyd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2960	5112	2026-08-08_851d6524f4cf328ce42da11d23e4fcd0_cobalt-strike_icedid_satacom_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-08_851d6524f4cf328ce42da11d23e4fcd0_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_851d6524f4cf328ce42da11d23e4fcd0_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- \Users\Admin\AppData\Local\Temp\vahbsdyd.exe
  2⤵
  - Executes dropped EXE
  PID:2960

vahbsdyd.exe

Path C:\Users\Admin\AppData\Local\Temp\vahbsdyd.exe
Size 27KB
SHA256 58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f
MD5 5da8c98136d98dfec4716edd79c7145f
SHA1 ed13af4a0a754b8daee4929134d2ff15ebe053cd
SHA512 6e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a
SSDEEP 384:Otj8FKzuRxmeWCJxhd2WS/YWyiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiB:QXif4CbPQ7
TLSH
T165C2D6273F6A2AD5DC2182F01F11070A5A256FD6360B0FBB714B7095CA35DE39CAABD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2960-2-0x0000020DCCA30000-0x0000020DCCA31000-memory.dmp

Download