Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe
- Size 1.7MB
- Sample260809-vedtgssbqf
- SHA256 ecb8afa9787e5a41bc90c35ab791cbe2bd51d69242659eaa00ef5ce2c2d7286b
- MD5 4a072c4ee793fd5622f24469dfb811ea
- SHA1 56129879ce30398d7768afea4329e7f41bcff5ef
- SHA512 968dc3b49ab6b34eb3f2f052643044bf5d212029ff3230154cd5b3c57958b5d89f5fbe3dc6bd7622057095a65e63df7aebfb76716b12cab721162c34a2909161
- SSDEEP 24576:+NVAsv9TPRMqmUGuTl+WOELWjoGcCzlbTw/c8uL5r1J9Vo489TU5GJ:+rAsBRtmUZgNj9JlbTINuL5R5oXa5W
- TLSH T10285126BEC6418F9FF7E023D8851424B87F074782715B58B81EE89114F21AFE1D2ABE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4768 wrote to memory of 1356 4768 2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe 90 PID 4768 wrote to memory of 1356 4768 2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe 90 PID 4768 wrote to memory of 236 4768 2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe 93 PID 4768 wrote to memory of 236 4768 2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4a072c4ee793fd5622f24469dfb811ea_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:236
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3104
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3720