1bc0ec0848bb1004fce517fa45b56c4418285c2763704bebd8ea38267835d841

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:27

Target
2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 222KB
Sample261006-pm9m8sys9q
SHA256 1bc0ec0848bb1004fce517fa45b56c4418285c2763704bebd8ea38267835d841
MD5 70b1de5f25fdca2a69b8bb3045c28c6c
SHA1 6b4e8e2a3599e1bfdede560736a89c5569f1df66
SHA512 18ee8def4e662d5588af59f5a9eba248627c4aadb9acc6d866cf9fc349e7eec7ca9320a96d2b8a1fe2c7f786ad21e58da846323041ccfc22fabf3e70ca294573
SSDEEP 3072:o6pctEVq/8hqaonUNK1BJIli6vy3pqtynpLdAT+PZJdXAC5GdvngkWERkQRX:o6pctEVq/8hfoU8c8GyI+R3XoYUX
TLSH
T151248D14B6E508FEE6B78579C9A24502DB737C424770DADF03904AA69F236D0DE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe
2500	2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4372	2500	2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc.exe --restart-fixture
  2⤵
  PID:4372