79aee6304be1513e0eb0fe51c7c64c4b995b4a580c731e1ead7670bb1443adcd

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 22:24

Target
2026-09-26_590c0ea390353dfb416b0c131582ae00_cobalt-strike_icedid_satacom_vidar.exe
Size 94KB
Sample260926-2bsa2att5m
SHA256 79aee6304be1513e0eb0fe51c7c64c4b995b4a580c731e1ead7670bb1443adcd
MD5 590c0ea390353dfb416b0c131582ae00
SHA1 3d90fcd5c23e124aefce1f4bb469fa783040febe
SHA512 c7b2907806f767e3290201e5d87e64eeaed66796c17d4372fca67993f65440475dee2d596fd899c8a07a552239777fd4cedfff12e414dd27c612af5093fe9b2f
SSDEEP 1536:4t0XrvH4azImmmKHFyZSETznkAuBDofqRsWFd09dlqA7Bt4:4t07x5mmKEt/nkAu+fGM4A774
TLSH
T17F935A5B72E530F8E476823988E11A05E776F83616218BAF07A446561F373E18D3EF35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4448	3028	2026-09-26_590c0ea390353dfb416b0c131582ae00_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4448 wrote to memory of 2240	4448	calc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-26_590c0ea390353dfb416b0c131582ae00_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_590c0ea390353dfb416b0c131582ae00_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2240