3f8145e80bd4da9b30099401ac16721571a79b6373b5b5cf4b325129e5d289ec

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 11:45

Target
2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid.exe
Size 106KB
Sample260819-nwtspstand
SHA256 3f8145e80bd4da9b30099401ac16721571a79b6373b5b5cf4b325129e5d289ec
MD5 3eccb8e55a0d362cd85fe9cb98c3d256
SHA1 034f1e581edb6aa4ead0f4d5d3a3ec590517c279
SHA512 9e979780936f1ea4934b7ee15c53d64dd72cf13bf456429aff58d445ccb48d2ffef9e9cdc700dd4231cbe16923721db3b313c0aab8c2ed742f639d0cefb69012
SSDEEP 1536:h/4p/3GFlOBsXoRDn5PSejFTH33SqY0da2lhtt/Xi43S1sWads9dl3lcufsVF9:h1P4VPSepnNY0Y2ZtPZCYEVlcesJ
TLSH
T1E5B36B5B63A530FCE5BB8638C4911A45E772B83207619FEF03A486561F236D18E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 4572	5888	2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid.exe	89
PID 5888 wrote to memory of 4572	5888	2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid.exe	89
PID 4572 wrote to memory of 940	4572	cmd.exe	90
PID 940 wrote to memory of 1468	940	calc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3eccb8e55a0d362cd85fe9cb98c3d256_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\System32\calc.exe
    calc.exe
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1468