5fb5108a71873fa2e0a6d40456f40ab55b31b2ebf61122a3e45793971f0bfe77

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
Size 1.5MB
Sample261020-16pyqaaw7k
SHA256 5fb5108a71873fa2e0a6d40456f40ab55b31b2ebf61122a3e45793971f0bfe77
MD5 431350050f4d4c5ed7d1fa899750adb1
SHA1 fb76121e9267a44e7ad011a636b7796f03bb8770
SHA512 4fa76bac8fa53591006ba436337316052d091fa2f21e6836951f97fc904f5f6a2bb81698288152bc7f696e29acb99707b1fa2dd431bf4186ac89bf2168e7b73d
SSDEEP 24576:N+twzlO9VkYzbOeZz38oT9dyvca5CJlTBs4zt6ap733k8:YCzlSVkY+0zFvZXlTBs4zgE7
TLSH
T170750816B76965D9C07BC078C2878E62A93130DA0B397EFB45D192792F25EF86E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4240	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	90
PID 3956 wrote to memory of 3928	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	91
PID 3956 wrote to memory of 5328	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	92
PID 3956 wrote to memory of 4928	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	93
PID 3956 wrote to memory of 696	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	94
PID 3956 wrote to memory of 3032	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	95
PID 3956 wrote to memory of 4144	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	96
PID 3956 wrote to memory of 5300	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	97
PID 3956 wrote to memory of 1416	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	98
PID 3956 wrote to memory of 1364	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	99
PID 3956 wrote to memory of 5284	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	100
PID 3956 wrote to memory of 3828	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	101
PID 3956 wrote to memory of 5624	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	102
PID 3956 wrote to memory of 2824	3956	2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:5328
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:5300
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom.exe" --exact child_entry --nocapture --test-threads=1
  2⤵
  PID:2824

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads