bebe9993ff329947bbe8e9e856b4b24663e271cfb5927f8dc2a124ac83537c91

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:41

Target
2026-08-09_bddc4fb393bc061935a8558a6b80e6d2_cobalt-strike_icedid_satacom.exe
Size 33.5MB
Sample260809-ntmllsek3v
SHA256 bebe9993ff329947bbe8e9e856b4b24663e271cfb5927f8dc2a124ac83537c91
MD5 bddc4fb393bc061935a8558a6b80e6d2
SHA1 882e03817c6931d30bab4a76da7cfe79cb587025
SHA512 40690ea7c539ad02f3103e17ead30989d2a88bc6c02aecf486d2568e7db20357cadf21369040c9048bdb4d6e096393949f6dc7b4b098c616405a01540763ecea
SSDEEP 786432:k2nnng9ZlQ5BSy3w/cv3svDJBVvRAQxopL7MglgRq/Ubs:k8g9vQ5BSQw/cv3GbVaQxo51lr/
TLSH
T1DF77334493E9747BE5A508F259A740B17B8089B2DF6F87B72CE1C1801F7B6924D3A3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 5020	4480	2026-08-09_bddc4fb393bc061935a8558a6b80e6d2_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bddc4fb393bc061935a8558a6b80e6d2_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bddc4fb393bc061935a8558a6b80e6d2_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:5020