Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 11:30
General
- Target 2026-04-15_972ed7d83dfe854d04d486fe7f96c2c3_cobalt-strike_icedid_satacom.exe
- Size 197KB
- Sample260415-nl46pacx4m
- SHA256 655fe6ccb17c698f1d5b12914a37e00b4108a8c05e5dc17323a4cd03217a46a3
Malware Config
Extracted
-
xworm
-
all.ddnskey.com:582
-
zebi.giize.com:582
-
zebi.kozow.com:582
-
all.ddnskey.com:0582
-
zebi.giize.com:0582
-
zebi.kozow.com:0582
-
Install_directory
%AppData%
-
install_file
svch0st.exe
-
localhost
127.0.0.1
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects DonutLoader 1 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_972ed7d83dfe854d04d486fe7f96c2c3_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_972ed7d83dfe854d04d486fe7f96c2c3_cobalt-strike_icedid_satacom.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Explorer.EXE'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Explorer.EXE'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svch0st.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svch0st.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mzvadbvn.wcd.ps1
memory/2000-76-0x00000182693B0000-0x00000182693C2000-memory.dmp
memory/2000-75-0x0000018268EB0000-0x0000018268EB8000-memory.dmp
memory/2000-74-0x0000018268DB0000-0x0000018268E0D000-memory.dmp
memory/2160-41-0x0000028424F00000-0x0000028424F10000-memory.dmp
memory/2160-58-0x000002840CA60000-0x000002840CA72000-memory.dmp
memory/2160-59-0x000002840C8D0000-0x000002840C8D8000-memory.dmp
memory/2160-42-0x0000028424F00000-0x0000028424F10000-memory.dmp
memory/2160-57-0x000002840AFB0000-0x000002840B00D000-memory.dmp
memory/3100-7-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3100-0-0x0000000000CC0000-0x0000000000CD7000-memory.dmp
memory/3100-8-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3100-6-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3100-4-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3100-5-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3100-3-0x0000000002730000-0x0000000002746000-memory.dmp
memory/3100-2-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/3372-93-0x00000273CCCE0000-0x00000273CCCF2000-memory.dmp
memory/3372-92-0x00000273CCCC0000-0x00000273CCCC8000-memory.dmp
memory/3372-91-0x00000273CCB20000-0x00000273CCB7D000-memory.dmp
memory/5044-16-0x000001DBD85E0000-0x000001DBD8602000-memory.dmp
memory/5044-38-0x000001DBD8400000-0x000001DBD8408000-memory.dmp
memory/5044-39-0x000001DBD8590000-0x000001DBD85A2000-memory.dmp
memory/5044-37-0x000001DBBFE10000-0x000001DBBFE6D000-memory.dmp
memory/5044-34-0x000001DBD83E0000-0x000001DBD83F0000-memory.dmp
memory/5044-33-0x000001DBD8B40000-0x000001DBD8B4A000-memory.dmp
memory/5044-31-0x000001DBD8B00000-0x000001DBD8B08000-memory.dmp
memory/5044-32-0x000001DBD8B30000-0x000001DBD8B36000-memory.dmp
memory/5044-30-0x000001DBD8B50000-0x000001DBD8B6A000-memory.dmp
memory/5044-29-0x000001DBD8AF0000-0x000001DBD8AFA000-memory.dmp
memory/5044-28-0x000001DBD8B10000-0x000001DBD8B2C000-memory.dmp
memory/5044-27-0x000001DBD88C0000-0x000001DBD88CA000-memory.dmp
memory/5044-26-0x000001DBD88E0000-0x000001DBD8993000-memory.dmp
memory/5044-24-0x000001DBD88A0000-0x000001DBD88BC000-memory.dmp
memory/5044-25-0x00007FF4A2940000-0x00007FF4A2950000-memory.dmp
memory/5044-10-0x000001DBD83E0000-0x000001DBD83F0000-memory.dmp
memory/5044-9-0x000001DBD83E0000-0x000001DBD83F0000-memory.dmp