Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 04:28
General
- Target 2026-04-26_17ea6a6c60705b85143c354375740517_cobalt-strike_icedid_satacom.exe
- Size 105KB
- Sample260426-e36amsdt6t
- SHA256 32931f9d4e8636f1282bc7a15515deac0947e463203fb3a28e9ae18a5d535888
Score
5/10
Malware Config
Signatures
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_17ea6a6c60705b85143c354375740517_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_17ea6a6c60705b85143c354375740517_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\calc.execalc.exe2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2912-2-0x000001DCF3810000-0x000001DCF3812000-memory.dmp
memory/2912-1-0x000001DCF3810000-0x000001DCF3812000-memory.dmp
memory/2912-0-0x00007FFB6D3E0000-0x00007FFB6D5E9000-memory.dmp
memory/2912-4-0x000001DCF36D0000-0x000001DCF3701000-memory.dmp
memory/3684-6-0x0000017CE67C0000-0x0000017CE67F1000-memory.dmp
memory/4700-5-0x00000216C28F0000-0x00000216C2921000-memory.dmp
memory/5504-7-0x000001BC59A50000-0x000001BC59A81000-memory.dmp