0c8daeb0c1c9a9403b7584df4c0fa1f56f41e9422d84b1e4b17cf16a3486c019

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:17

Target
2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe
Size 33.5MB
Sample260809-rl5c8sswew
SHA256 0c8daeb0c1c9a9403b7584df4c0fa1f56f41e9422d84b1e4b17cf16a3486c019
MD5 68e141e5d4dcf27e053c73cce6f46a7c
SHA1 dddb757593f8e5984cf7699ad9eb620023a6db14
SHA512 8480ecc7002d9d3dd7535cadc1ae897c5448707dd353686e7d513ff72c482a28e57dc76429445a9f4d91e26c3cf2db63b3c2bde97ba14958c4322e08d1c3d418
SSDEEP 786432:XzwxPtl03CFZrA+s5DSBTVCeGf6knHLu+bE4tYGOmgBYzJ5R:s1P03ST8St1EFbE4tpWy
TLSH
T13F7733033D8326C2D31A91B2F62E35E77761F90575A6E22B273442F5AFC82A46C711DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4136	1976	2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_68e141e5d4dcf27e053c73cce6f46a7c_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:4136