9bb0a46b036ea828ad3c593b95e628f51d60e4a557799e9d65869cf823ec668b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 18:46

Target
2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
Size 118KB
Sample260808-xexmpsfa94
SHA256 9bb0a46b036ea828ad3c593b95e628f51d60e4a557799e9d65869cf823ec668b
MD5 b743bbc04657a795e1ac8d6f2df11af1
SHA1 58d82923117a41778ef40f5c9b6878a1e8d40dae
SHA512 b656ac292f8c7c59f34a790ea532c03bf8c823521ad0cb5560c40cffb4c2e1a8e6d7a8e94a07ad903a072e1d5865cdbaed79e4bd36a50142dff5bfad1178e519
SSDEEP 3072:JFG0Tpu8or8Hoe50or0GOKhLEQUdhp8eUS:JggpuSj50a0GFUHieU
TLSH
T1AEC36D97A3E530F8F57B8638C4A10A49D772B83207609FEF07B486561F236D19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87
PID 2064 wrote to memory of 764	2064	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe"
  2⤵
  PID:764

memory/764-0-0x0000000140000000-0x0000000140007000-memory.dmp

Download

memory/764-1-0x0000000140000000-0x0000000140007000-memory.dmp

Download

memory/764-2-0x0000000140000000-0x0000000140007000-memory.dmp

Download

memory/764-3-0x0000000140000000-0x0000000140007000-memory.dmp

Download