Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 16:10
General
- Target 2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe
- Size 937KB
- Sample260415-tmkrbsfw5x
- SHA256 d89a0439b61dc4f482d59a1b0db2e7f5b66f4f4d0abd1bbc459e0ca6ab9e2796
Score
10/10
Malware Config
Extracted
Family
-
stealc
Botnet
-
zorizxcq
C2
-
http://95.85.238.4
Attributes
-
url_path
/e99c8470d3ebe7696e4a.php
rc4.traffic_key
rc4.C2
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Detects Stealc stealer Version 2 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5c1eca049dbe66688f345990ed075e17_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\17da2719abf1.exe"C:\Users\Admin\AppData\Local\Temp\17da2719abf1.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
17da2719abf1.exe
memory/812-4-0x00000253736B0000-0x000002537379A000-memory.dmp
memory/812-5-0x0000025375310000-0x0000025375319000-memory.dmp
memory/2992-6-0x00000284D5610000-0x00000284D56AE000-memory.dmp