5d3ffe997158a42634dc34409dae4295b84839ccc0a4e841fd0f573110dd6f90

Analysis

max time kernel
164s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_5f6fbfb67f2a7dfa9ab2c55c911c04bc_cobalt-strike_icedid_satacom.exe
Size 1.7MB
Sample260825-pfl9csx1ht
SHA256 5d3ffe997158a42634dc34409dae4295b84839ccc0a4e841fd0f573110dd6f90
MD5 5f6fbfb67f2a7dfa9ab2c55c911c04bc
SHA1 36b2cf4f1274154428db002be6065af1974dc297
SHA512 db0d4ede3829ba0d66855eab69698668bebb8b66514863a18a86d9931e1b2b4948b761460b83df76ade260406b6d78033e3f91f3178176001825b9404b810676
SSDEEP 24576:NKW6C8fMeatgyCY5m9np5/LeIStFA3WJ3F5ahOlTf9fIdxZ10mS6Bzk1S3H1nXRq:NK9C8fMRn5mhCI0FAt8Tf9fNya4h50
TLSH
T1EB858E2D9ED068F6E43FD5F6C850C880E87B62595B8D7BD94D801A8F6F0A365EC143AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2448	shuzalgv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2448	1416	2026-08-24_5f6fbfb67f2a7dfa9ab2c55c911c04bc_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5f6fbfb67f2a7dfa9ab2c55c911c04bc_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5f6fbfb67f2a7dfa9ab2c55c911c04bc_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Roaming\shuzalgv.exe
  "C:\Users\Admin\AppData\Roaming\shuzalgv.exe"
  2⤵
  - Executes dropped EXE
  PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shuzalgv.exe

Path C:\Users\Admin\AppData\Roaming\shuzalgv.exe
Size 798KB
SHA256 f234c64c47b19eaebb695cca70c46ca1d03f9bef5d2baae557b3b9a87986eb4f
MD5 dae367d01c1b78125032be45b147b3e4
SHA1 cefb807aa2e3ca23df702d421d230da188026c28
SHA512 6ac9d1b238c01973e23fbfe612fc0e2fa825cdd5674e262081265e44d9e528e8f79b6278f9c0e4cc306132d914ca25e6b13093289d30c875a0ace2f3c2739325
SSDEEP 24576:4gUUhsCEFbhC4t3BLO1DR+nKtDU7BtzluDOsc:3UpCEFbhC4t3BLOWjB70
TLSH
T13D055C766A4801ACE275D5F8DE2D58D3E371F4470331ADEF0BD1B8A50E0A9D86A7AF10
MD5 SHA1 SHA512 SSDEEP TLSH