Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 16:57
General
- Target 2026-05-03_e1bf3f158129308a25f5756ee33e56ca_cobalt-strike_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm.exe
- Size 418KB
- Sample260503-vglbcadz51
- SHA256 7298c3160e3b6b6e533f320d06a08d69a746f4bb5509d8803c1ee204c02eab4b
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- Executes dropped EXE 1 IoCs
- Modifies system executable filetype association 2 TTPs 3 IoCs
- Modifies registry class 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_e1bf3f158129308a25f5756ee33e56ca_cobalt-strike_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_e1bf3f158129308a25f5756ee33e56ca_cobalt-strike_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
audiodg.exe
shost.exe
memory/4872-16-0x00000000008F0000-0x0000000000906000-memory.dmp