9bb0a46b036ea828ad3c593b95e628f51d60e4a557799e9d65869cf823ec668b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:46

Target
2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
Size 118KB
Sample260808-xexmpsfa94
SHA256 9bb0a46b036ea828ad3c593b95e628f51d60e4a557799e9d65869cf823ec668b
MD5 b743bbc04657a795e1ac8d6f2df11af1
SHA1 58d82923117a41778ef40f5c9b6878a1e8d40dae
SHA512 b656ac292f8c7c59f34a790ea532c03bf8c823521ad0cb5560c40cffb4c2e1a8e6d7a8e94a07ad903a072e1d5865cdbaed79e4bd36a50142dff5bfad1178e519
SSDEEP 3072:JFG0Tpu8or8Hoe50or0GOKhLEQUdhp8eUS:JggpuSj50a0GFUHieU
TLSH
T1AEC36D97A3E530F8F57B8638C4A10A49D772B83207609FEF07B486561F236D19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89
PID 4840 wrote to memory of 3992	4840	2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b743bbc04657a795e1ac8d6f2df11af1_cobalt-strike_icedid.exe"
  2⤵
  PID:3992

memory/3992-0-0x0000000140000000-0x0000000140007000-memory.dmp

Download