007f560d8411f55b8371f382f289097edec99637c0e0cfdcfad27bdf896145b8

General

Target
2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe
Size 341KB
Sample260603-capfbah12q
SHA256 007f560d8411f55b8371f382f289097edec99637c0e0cfdcfad27bdf896145b8
MD5 8b1b0a25526cf3fc1724159990adfff3
SHA1 95d6fed51f5c7d791c371bde3f9c296528e328f1
SHA512 ff9a9d59b62dee90bf7a7ecdf0e179ec234d94c530241874d4580ef611348c9e4d9d56d75f49d4482eda8865d85bfc71a7905b19a9aa45951744680388fdda1c
SSDEEP 3072:y2WJlfr5L7KTbI2QC9RjDfwQqEqstuLFctZsMm4O7E7ONQhjd72bNwnaC/p/+etc:KL7Wb++hp0WOtihjFmSaC/1VI82vClc
TLSH
T11D747D16F7E510FBE1778578C9634906EB7278460760ABDF03A44A9AAF237D08D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8C473A6FDE4E09F84F3459B111D3F364FAF2C90F\Blob = 0300000001000000140000008c473a6fde4e09f84f3459b111d3f364faf2c90f2000000001000000cd040000308204c9308203b1a00302010202146e6751c7e59c53816b20af44a59ed29eb1efc3f5300d06092a864886f70d01010b0500308183310b3009060355040613025553310b300906035504080c024e593111300f06035504070c084e657720596f726b311e301c060355040a0c15476f6f676c652054727573742053657276696365733114301206035504030c0b6b6579617574682e77696e311e301c06092a864886f70d010901160f43777562734043777562732e636f6d301e170d3235303532323131323735375a170d3236303532323131323735375a308183310b3009060355040613025553310b300906035504080c024e593111300f06035504070c084e657720596f726b311e301c060355040a0c15476f6f676c652054727573742053657276696365733114301206035504030c0b6b6579617574682e77696e311e301c06092a864886f70d010901160f43777562734043777562732e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ca5c028ae8fd3561dafbfded250af8ae6b46504e1c859303a2f46996c28b521966e3c4a470f714e16f23711bb3434c3a4b2f7b01c6562e8999d05717cf9600bfc90f99459d5870585abc7cfa4c5d0944c4300008f1e0a5c7d3f7ca7d6b85c9ae50819b427ab8822aab8c9bbee98eca3ced46ec9c9a1f1828aa8644b5cb87caee626eab35a2b1c1b1281456d9c3e0f8230b4a256d0a248e5cc4edd3dc9ea61db37c4f608a60ea7c9399016dfb8998df87ada6c619ecc40ffc509925b61ac6befd7a1b68d142b78051ee65c3ddb82710d764b2709e8785c37b5a099986ada31dc85c95151fa851ecd543407b0c90f8c8821423c3255e1aeadf7341433c627c6ee30203010001a38201313082012d301d0603551d0e041604147e1ad526e309b188276d5bf5bf3efe83b93589ab3081ad0603551d230481a53081a2a18189a48186308183310b3009060355040613025553310b300906035504080c024e593111300f06035504070c084e657720596f726b311e301c060355040a0c15476f6f676c652054727573742053657276696365733114301206035504030c0b6b6579617574682e77696e311e301c06092a864886f70d010901160f43777562734043777562732e636f6d82146e6751c7e59c53816b20af44a59ed29eb1efc3f530090603551d1304023000300b0603551d0f0404030205a030160603551d11040f300d820b6b6579617574682e77696e302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465300d06092a864886f70d01010b050003820101009ea7f0a2ba9dde4e3bf5de7a91ffec157c3f40670bacd85fa32d1efdfaf80c983037387ce43d0998b0c3d53e16f0566dd86f925cc92d089c914d9d344eef63057ec70defba1e7abc69a8585cfb30d1e5ee5171eef5c7c6f7ca66ebe08bf9fe2cdfa605aa34caedb67c85acb18258ba374b876a0cce549580ea3d84ec3f115833c2cea43ef59d6ab52673716e1f2ab62bb3fc6caf9a643b01545d0fe082aa58a8f021a500a1451c02610be70d45169eaa9e10b60ef494c94e2005329a6ea95c7de417e93a9dafa197babe7d3daecfcee0b571c9d98eda4dedaf96cc3e447b384b9506a295051120bc4d62004c47f95f602f84e9646fd3b7133a47a1eeb6fb1c47	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5460	ipconfig.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8C473A6FDE4E09F84F3459B111D3F364FAF2C90F	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5304	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe
Token: SeDebugPrivilege	5304	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 3360	5304	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe	84
PID 5304 wrote to memory of 5268	5304	2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe	85
PID 5268 wrote to memory of 5460	5268	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_8b1b0a25526cf3fc1724159990adfff3_cobalt-strike_icedid_stealc.exe"
1⤵
- Drops file in Drivers directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5460