Overview

overview

10

Static

static

10

2026-05-28...lc.exe

windows10-2004-x64

9

2026-05-28...lc.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 17:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_910da263ce3bb768b5c9bd55739623de_cobalt-strike_icedid_satacom_stealc.exe
  • Size 288KB
  • Sample260528-v7hcdahs5j
  • SHA256 2d4100c7280935808b1b93b6277e377fa21a01eb00a052c355c8ae888885500a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Custom signature
    Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_910da263ce3bb768b5c9bd55739623de_cobalt-strike_icedid_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_910da263ce3bb768b5c9bd55739623de_cobalt-strike_icedid_satacom_stealc.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Local\Window\System.exe
      C:\Users\Admin\AppData\Local\Window\System.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        • Size 808B
        • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7E7D146147E46C8361E336CACF0A16E6
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7E7D146147E46C8361E336CACF0A16E6
        • Size 212KB
        • SHA256 d3013c85457f2b5b250e891bd734c82b63b528d8b37dede0fb5ef244cc79d6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 1KB
        • SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
        • Size 528B
        • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        • Size 192B
        • SHA256 7a14271af70b4416b08f49d940e2938c64f2ad53345cda1a663f5d2d89b6badf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7E7D146147E46C8361E336CACF0A16E6
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7E7D146147E46C8361E336CACF0A16E6
        • Size 246B
        • SHA256 84a8704ed42d6762b9381adce902b1ab9b61b7202d6c921707ee0eb9a4af2403
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 174B
        • SHA256 0bb8f67783cc30246d24a0626e5be0de26de645f787ed9dc42e5c5e48d36c231
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
        • Size 170B
        • SHA256 830d11f361520e2e4f4c2d24c396584f38538bd7971ed4ec34f7fa5b0ce9ff98
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        System.exe
        • Path C:\Users\Admin\AppData\Local\Window\System.exe
        • Size 254KB
        • SHA256 1ba6bbd43d221bac7d90ed5f8d5637fd463681ff31f6488ad9e4500119070b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shot.exe
        • Path C:\Users\Public\Window\shot.exe
        • Size 36B
        • SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
        • MD5 SHA1 SHA512
        Submit Download