0c8daeb0c1c9a9403b7584df4c0fa1f56f41e9422d84b1e4b17cf16a3486c019

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:17

Target
2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe
Size 33.5MB
Sample260809-rl5c8sswew
SHA256 0c8daeb0c1c9a9403b7584df4c0fa1f56f41e9422d84b1e4b17cf16a3486c019
MD5 68e141e5d4dcf27e053c73cce6f46a7c
SHA1 dddb757593f8e5984cf7699ad9eb620023a6db14
SHA512 8480ecc7002d9d3dd7535cadc1ae897c5448707dd353686e7d513ff72c482a28e57dc76429445a9f4d91e26c3cf2db63b3c2bde97ba14958c4322e08d1c3d418
SSDEEP 786432:XzwxPtl03CFZrA+s5DSBTVCeGf6knHLu+bE4tYGOmgBYzJ5R:s1P03ST8St1EFbE4tpWy
TLSH
T13F7733033D8326C2D31A91B2F62E35E77761F90575A6E22B273442F5AFC82A46C711DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4924	4056	2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:4924