aaece993d64ca534c759a043e0cfaf9a235489647468ef5b19215454fd7b0a6c

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 09:06

Target
2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe
Size 22.4MB
Sample260905-k2rnrax1c1
SHA256 aaece993d64ca534c759a043e0cfaf9a235489647468ef5b19215454fd7b0a6c
MD5 6257596067d2c9a92004300fb60c6bee
SHA1 1497956850136260d978e897b06c42bbc258660f
SHA512 3660067fd683279b988babc13096af477c254f5a38da019130128476453dcc9394def7a646e2404fe9dd15360d4e504460d1657b487b4312e8f89ffb659a5675
SSDEEP 393216:s8ThivQDhYd6AcySU87F/osIkCC3TVGiAtt1/LYYfl0PMNYRUYpto60ZHAw:sfCWd6gUux+5lAtD/LYYfeK+toKw
TLSH
T14037339630A6A4FDE4D268BAD6BCC5870B94112D02DB07FECA9731DB7F5A16C3E31061
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89
PID 3644 wrote to memory of 2088	3644	2026-09-04_6257596067d2c9a92004300fb60c6bee_cobalt-strike_icedid_satacom.exe	89

memory/2088-11-0x00007FF765FF0000-0x00007FF766049000-memory.dmp

Download

memory/2088-6-0x00007FF765FF0000-0x00007FF766049000-memory.dmp

Download

memory/2088-0-0x00007FF765FF0000-0x00007FF766049000-memory.dmp

Download