6481735d6a458ccf3234c276eae42fb1d44d8726a0595666174368b1dbdbdd37

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 20:41

Target
2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 217KB
Sample260815-zgssmsgm7w
SHA256 6481735d6a458ccf3234c276eae42fb1d44d8726a0595666174368b1dbdbdd37
MD5 5d3a02820c497a565777807fc489fb1b
SHA1 aa20b0983882688d0838a43fa2791a12d1b268e7
SHA512 4d391d1938f85d6a33df833ca39ee79140fa491c898560e65fff78d61a5b80208e5fe945b819ebe095335f83a0c22db504f991f81c5d68b9b20818cd2354426a
SSDEEP 3072:xmLGKq4AxrXSGWQDuUClEkSRIb5VdMbRvArs34R4wcvxV5bJEb+Grnsxe0:oKKqXx7uUqpVdgmg4RdcvxVpI+2nsxe
TLSH
T10324D05B33A930F9F0B6827984961649DB76BC361B619FDF03A006961F372D44D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4968 set thread context of 4476	4968	2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe	88

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4476	4968	2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe	88
PID 4968 wrote to memory of 4476	4968	2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d3a02820c497a565777807fc489fb1b_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4476

memory/4476-0-0x0000000140000000-0x000000014001E000-memory.dmp

Download