4961300123840b597ac919f4ed1475057c00defa02a3cdd86e5286ad5326742a

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:34

Target
2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe
Size 637KB
Sample261104-w75ncacv91
SHA256 4961300123840b597ac919f4ed1475057c00defa02a3cdd86e5286ad5326742a
MD5 65382850314464763d05aa6494776d04
SHA1 c688a90a78c0cea73d0105cba2a8748207e8955c
SHA512 37a9d919a00d5d317c3ed4403241c4cce3e1dc63af908bf1373bfa4b0a1be160f09d519a7c675d0ccf34e5bf57ad6a72259c2d915a893d1aa717be6083bb89ca
SSDEEP 12288:c7YvFLYAf0BvmgfL6COWnrfpgqw76K9O8tu/WBvogj+5YcMd:wCLT0UKL6COWrBgqoTSBad
TLSH
T1F6D4E08AEA6169EED921803A44950934F7617C338761C7EB9B650217CE2F2D4DE3BF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1276	2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe
1276	2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe
1276	2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe
1276	2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_65382850314464763d05aa6494776d04_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1264