9d745b9466fe569ed7e3f9a76d1c7f416960ef7ee5a2f9dcc54c69695c89c843

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 05:10

Target
2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe
Size 3.9MB
Sample260825-ft4k5axane
SHA256 9d745b9466fe569ed7e3f9a76d1c7f416960ef7ee5a2f9dcc54c69695c89c843
MD5 a6b8ded591f2430200e69fc2a854ea1d
SHA1 5cd59f9a6a477777f2c378a4330b8330fe4b3eca
SHA512 47e1f0f672be2b5df0c43b6c9aba62f50d380fea1e46d49cb589493e9fac56a5686e16a209ab4bcc48eddb17fef4607a09c39a7b8760e8b234e6c102aa70fe2e
SSDEEP 49152:IWPP7/Dr7ZiviNpVkclOsgmML5MzLDY1wwrP9ZrHM0PP6UvCfWDoADIBN9//uf4:VnbDnZoiBfOAOKPYvP9ZrVa2CfWDv4
TLSH
T13916F11BAAA810E1D1B7C03EC9E7565FFDB13496433197C707948A9A1B27BF49A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2224	2520	2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe	90
PID 2520 wrote to memory of 2224	2520	2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe	90
PID 2520 wrote to memory of 1728	2520	2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe	93
PID 2520 wrote to memory of 1728	2520	2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_a6b8ded591f2430200e69fc2a854ea1d_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact