791260b53e58c32f8c5bb51443b8c59cdeb5c18db9f4de0f533891ff7a308922

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:38

Target
2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe
Size 22.4MB
Sample260905-nrpcesde67
SHA256 791260b53e58c32f8c5bb51443b8c59cdeb5c18db9f4de0f533891ff7a308922
MD5 4b43cdba8bb23eb7720bf87df60192d8
SHA1 caaa2bb30a024de5bab4db89dd107e0033d6d745
SHA512 97f82d9c20c7c1b63f88fa3879b49c6d97b11d25b820219be4ae2a7e7ef4d17f521938332ae88e84db0d0ff0d3fcb4d4a2322f0ac322b120642f5a38e09d5e99
SSDEEP 393216:9GwXRDMBqYGyRrATpmF12ys3xQPQtSb0r8DtQAKdXYjDXeXcph78ayz1f7KQR:9GSRDJNA4pm1sxQPQA48DQIjDXechhyN
TLSH
T1073733A245C90DF7DF4EC1FC88859E7C2AE51AA16E23F1B74B1829169D221C94C3FD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5136 set thread context of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89
PID 5136 wrote to memory of 5628	5136	2026-09-04_4b43cdba8bb23eb7720bf87df60192d8_cobalt-strike_icedid_satacom.exe	89

memory/5628-11-0x00007FF6DF710000-0x00007FF6DF769000-memory.dmp

Download

memory/5628-6-0x00007FF6DF710000-0x00007FF6DF769000-memory.dmp

Download

memory/5628-0-0x00007FF6DF710000-0x00007FF6DF769000-memory.dmp

Download