25dc31a08f3b5d6e3af3896967e9ecfa995ff4f863e8bd08fc298253fb6ebfae

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:00

Target
2026-08-09_fdfaf10d68667378d6fc3204eaeacde6_cobalt-strike_icedid_satacom.exe
Size 33.5MB
Sample260809-m35ccaab53
SHA256 25dc31a08f3b5d6e3af3896967e9ecfa995ff4f863e8bd08fc298253fb6ebfae
MD5 fdfaf10d68667378d6fc3204eaeacde6
SHA1 c6c1350489fb3e3b70c16216b6de3864c6e776c3
SHA512 eea1a6ac26806872ce3c354968388d4b67fd3b925e02338cbfa305e7cdb544259e12c7436549b65892ee82697faae5ef9915621cb4cf739a8c3f3530ac6c08a0
SSDEEP 786432:n2nnng9ZlQ5BSy3w/cv3svDJBVvRAQxopL7MglgRq/Ubs:n8g9vQ5BSQw/cv3GbVaQxo51lr/
TLSH
T11477334492E9747BE56508F259A740B17B8089B2EF6F87B72CE1C1801F7B6934D3A3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4748	1932	2026-08-09_fdfaf10d68667378d6fc3204eaeacde6_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_fdfaf10d68667378d6fc3204eaeacde6_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_fdfaf10d68667378d6fc3204eaeacde6_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:4748