d3133d7fb3685e19ccf481a4627554c2aa6945706ac53058169971688ed18cf9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_13ea6d35fe29fc3590855177d1af22c5_cobalt-strike_icedid_satacom_vidar.exe
Size 176KB
Sample260507-e44s7sey8x
SHA256 d3133d7fb3685e19ccf481a4627554c2aa6945706ac53058169971688ed18cf9
MD5 13ea6d35fe29fc3590855177d1af22c5
SHA1 4053cdb19279a3e6216dc3b4fc6581fe6c89bfd4
SHA512 2084a6456e29a79d451a443ded96e28892f124dd23e7ce0c321dd65b14c9a492977e9148c4a311e5991eab0196bebec994cae50316cad530bd1611efe18b6cf8
SSDEEP 3072:QfQO9540jOtBEoK4RZxIwfRhAkgMB7xa2JU:Qf3QtBvV3IwvakU
TLSH
T1A9042A17B2E532F5D0224236C5C12315E37A787517614AEFCAAA46B90E13AFD4E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5624	cl2853.tmp

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
15	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1472	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5836	3264	2026-05-07_13ea6d35fe29fc3590855177d1af22c5_cobalt-strike_icedid_satacom_vidar.exe	79
PID 5836 wrote to memory of 5624	5836	cmd.exe	81
PID 5836 wrote to memory of 1472	5836	cmd.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-07_13ea6d35fe29fc3590855177d1af22c5_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_13ea6d35fe29fc3590855177d1af22c5_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c C:\Users\Admin\AppData\Local\Temp\cl2853.tmp x -o+ -p"3us29@83&xd*nKDw" "C:\Users\Admin\AppData\Local\Temp\cl2854.tmp" "C:\Users\Admin\AppData\Roaming\Microsoft\" & schtasks /create /sc minute /mo 6 /tn "Office360\Update\TaskMachine" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\OfficeUpdate.exe\" \"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\updcfg\" \"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\upddat\"" /f & C:\Users\Admin\AppData\Roaming\Microsoft\Office360\Office_360.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Users\Admin\AppData\Local\Temp\cl2853.tmp
    C:\Users\Admin\AppData\Local\Temp\cl2853.tmp x -o+ -p"3us29@83&xd*nKDw" "C:\Users\Admin\AppData\Local\Temp\cl2854.tmp" "C:\Users\Admin\AppData\Roaming\Microsoft\"
    3⤵
    - Executes dropped EXE
    PID:5624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 6 /tn "Office360\Update\TaskMachine" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\OfficeUpdate.exe\" \"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\updcfg\" \"C:\Users\Admin\AppData\Roaming\Microsoft\Office360\upddat\"" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cl2853.tmp

Path C:\Users\Admin\AppData\Local\Temp\cl2853.tmp
Size 514KB
SHA256 02e81c62ed9bc3f3a1861aacc9502f868a75521f90a51112008f156e343aa6c5
MD5 c0a4343cf9223c4208246e0de274a846
SHA1 90d3865065525f345a0bfe7121cecb99480f354f
SHA512 381385cdeccd6722c49523128d686a150967eeb090bd910e16efb93d78aed9414bc307cb5532981ff81c8e4c9dd2ea24c32a922df60d25c73ed183991a3e052e
SSDEEP 6144:YqsknOlpvtmeO6DV9U2EujTQVy5v/1wgO70KNmHz6c13497oS7w1Gmy5UXI3M:YqskOPF5bBjpv/1wgOwwmHLZgbUXI3M
TLSH
T1CBB48E59E7F500B8E077D679CDA6465BEBB238515A30874F03A5CB6E2F23760C936322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cl2854.tmp

Path C:\Users\Admin\AppData\Local\Temp\cl2854.tmp
Size 1.4MB
SHA256 3e5718f49332e0f7144f7c64b2f7d2695a27f6bd17eb151c968f4cec09bdbdfe
MD5 4786c9bc843cfb7f018cb05b44dd1c78
SHA1 7554234c76daccb073b271466f1affd69215abcf
SHA512 c68e92964d70c7db9b6507839f4490bd43bd707548ca4dd21de1ce65049ad8f54ebce1720e45d59516d6a4a75c6313c9683102b542655e62fa61b75c66c8ba13
SSDEEP 24576:+D+ZxNJzZ99VNb+WKFi1DzMJeELNbIw4WlEf2Z5t5qahdV2Sq4G3Ake43JSXh0+c:m+ZHJ1HH111DMeEcwFF5qIdV2S5G3De0
TLSH
T1FA6533955AEB29B3DF9FEF97F91010C56B628BEC750721C0A35860759E200BC8F7B186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-0-0x000002C8BF330000-0x000002C8BF3DE000-memory.dmp

Download

memory/3264-7-0x000002C8BF330000-0x000002C8BF3DE000-memory.dmp

Download

memory/5624-38-0x0000000000870000-0x000000000091E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads