98f2616af26a17589d1427d80c70a12027d410a55845b7478e13db87ccc7299a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:30

Target
2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe
Size 315KB
Sample261102-w5nl2scv4y
SHA256 98f2616af26a17589d1427d80c70a12027d410a55845b7478e13db87ccc7299a
MD5 f1cd4eb838811d2ce62bd947da9dfecb
SHA1 28d9d82d6ca8c88aebd41fa70fd56598b23c8d53
SHA512 211069b2195492b1a61e94c8b08f80dfb3b773e3d201bdbe5d80798ebfa9e72986da76b2ae6864a934a683bfd4cecc4a42d2825320ca113966da781dec843f58
SSDEEP 3072:4nTcwI9JK0UW6D0fJbNxj7xYWd1z5MclPfgK1L4vCP+iV47xdc/B+alKL6K85eRC:Gl+A+z5Hbh4CHn4AeJe7raOT
TLSH
T1FE64070AF7B511F5E6BBC53889926506F9727C654B60E7CF23500A8A2E23BD0DD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4452	3136	2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-02_f1cd4eb838811d2ce62bd947da9dfecb_cobalt-strike_icedid_njrat_satacom.exe" --private-prompt-sender-fixture
  2⤵
  PID:4452