Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 11:53
General
- Target 2026-06-02_30f6c6a5a0ba9904c555dba0f61973f4_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 1.0MB
- Sample260602-n2sgtsdv2k
- SHA256 56a0fefcaf393ba740854c24083bae53d92524917fdb8f4080aa008a58e4908e
Malware Config
Signatures
- Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_30f6c6a5a0ba9904c555dba0f61973f4_cobalt-strike_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_30f6c6a5a0ba9904c555dba0f61973f4_cobalt-strike_icedid_satacom_stealc_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-1-0x000001FCCA2BA000-0x000001FCCA2BB000-memory.dmp
memory/672-0-0x00007FFB20900000-0x00007FFB20901000-memory.dmp
memory/672-2-0x000001FCCA5C0000-0x000001FCCA6A4000-memory.dmp
memory/672-4-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-3-0x000001FCE2CC0000-0x000001FCE2E82000-memory.dmp
memory/672-5-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-6-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-7-0x00007FFB20900000-0x00007FFB20901000-memory.dmp
memory/672-8-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-13-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-14-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-16-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-19-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-20-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp
memory/672-21-0x000001FCC9AF0000-0x000001FCCA5B2000-memory.dmp