6ba3274fc7e71232e72d42fba344b6b271e69dad125c91252b862ea68a974fb5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_ce6e7e27b74954b946c324d8cd49fd4e_cobalt-strike_icedid_satacom.exe
Size 1.8MB
Sample260523-mbkhvsav7w
SHA256 6ba3274fc7e71232e72d42fba344b6b271e69dad125c91252b862ea68a974fb5
MD5 ce6e7e27b74954b946c324d8cd49fd4e
SHA1 131bf7f8346bab7cd09cae9f0ac6717407fffea2
SHA512 493d5952c58fad6fca0757665410803924919c658f0ab390d18aafa6301213ac3d98b99e7c461b1d6788333f4799cd05f1e31dd0eb4be3018ebe61a5b086e6f7
SSDEEP 49152:ZelL7ceMfRpZNHLFehLLv5x3+r5vyNx6bN21G6ZHS:ZVvZLe
TLSH
T1F295CF7697132335EC46E0789A24D432E382F1BC7A199272F9CE115B37075BC8A79AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-05-23_ce6e7e27b74954b946c324d8cd49fd4e_cobalt-strike_icedid_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1264	2272	2026-05-23_ce6e7e27b74954b946c324d8cd49fd4e_cobalt-strike_icedid_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-05-23_ce6e7e27b74954b946c324d8cd49fd4e_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_ce6e7e27b74954b946c324d8cd49fd4e_cobalt-strike_icedid_satacom.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads