ce89db856cf84c3f0e50d476d86b824f24dab6687ae30c56ea1fcffadb95fddf

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 11:56

Target
2026-10-02_5c7eb0749fdc106d17ea8e46de581fc0_cobalt-strike_icedid_ryuk_satacom.exe
Size 2.6MB
Sample261003-n34aqada49
SHA256 ce89db856cf84c3f0e50d476d86b824f24dab6687ae30c56ea1fcffadb95fddf
MD5 5c7eb0749fdc106d17ea8e46de581fc0
SHA1 7723929070424e640f644fc41ad31272ac7e4b32
SHA512 1fa57e185616ab04c4533e9e38442431746b74e6cb54c0918eddbb14dd018af2a3698de8afa0ed3fbd3dd7989c9e288792758f923304cfefbe562a6b0ef76635
SSDEEP 49152:gSOtVjMaAHb4Zhs1/PUoTytztV4/hrAoYSbuzMWFQLmuiDnn:gSaMHbkyRDTykuYQ0An
TLSH
T1E4C5CF835AE5186CD3A3A03929DF5763C137FA000F2D69FB259C62653A725CE707A70E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5568	2026-10-02_5c7eb0749fdc106d17ea8e46de581fc0_cobalt-strike_icedid_ryuk_satacom.exe
5568	2026-10-02_5c7eb0749fdc106d17ea8e46de581fc0_cobalt-strike_icedid_ryuk_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_5c7eb0749fdc106d17ea8e46de581fc0_cobalt-strike_icedid_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_5c7eb0749fdc106d17ea8e46de581fc0_cobalt-strike_icedid_ryuk_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5568