Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 05:10
General
- Target 2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe
- Size 283KB
- Sample260426-ft8j3set5t
- SHA256 3c1bd44a092f6dff2102aafc5c82b20b464abd5f33e568049cecfd228b3d67d2
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSecurityHealthService.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSecurityHealthService.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsSecurityHealthService.exe
memory/2780-27-0x0000000140000000-0x0000000140034000-memory.dmp
memory/2780-25-0x0000000140000000-0x0000000140034000-memory.dmp
memory/2780-17-0x00007FFF00EA0000-0x00007FFF010A9000-memory.dmp
memory/2780-28-0x0000000140000000-0x0000000140034000-memory.dmp
memory/2780-26-0x0000000140000000-0x0000000140034000-memory.dmp
memory/2780-29-0x0000000140000000-0x0000000140034000-memory.dmp
memory/2780-30-0x00007FF78F7A0000-0x00007FF78F7EB000-memory.dmp
memory/2780-15-0x00007FF78F7A0000-0x00007FF78F7EB000-memory.dmp
memory/4504-11-0x0000000140000000-0x0000000140034000-memory.dmp
memory/4504-1-0x00007FFF00EA0000-0x00007FFF010A9000-memory.dmp
memory/4504-12-0x0000000140000000-0x0000000140034000-memory.dmp
memory/4504-0-0x00007FF7137E0000-0x00007FF71382B000-memory.dmp
memory/4504-2-0x0000000140000000-0x0000000140034000-memory.dmp
memory/4504-9-0x0000000140000000-0x0000000140034000-memory.dmp
memory/4504-10-0x0000000140000000-0x0000000140034000-memory.dmp
memory/4504-31-0x000001B38E3C0000-0x000001B38E3CC000-memory.dmp
memory/4504-38-0x00007FF7137E0000-0x00007FF71382B000-memory.dmp