Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
06/06/2026, 02:11
General
- Target 2026-06-06_511a364fc6cc3e364bd9081e4170339c_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 4.4MB
- Sample260606-cmd54sg16z
- SHA256 c2d18d173512699b325ab09b4a8b1eebb48f667966c5ffe06b0547fa2de8c82c
Malware Config
Signatures
- Detects executables packed with unregistered version of .NET Reactor 64 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_511a364fc6cc3e364bd9081e4170339c_cobalt-strike_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_511a364fc6cc3e364bd9081e4170339c_cobalt-strike_icedid_satacom_stealc_vidar.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4676-0-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-1-0x00000163541C0000-0x00000163546B8000-memory.dmp
memory/4676-2-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-3-0x000001633A000000-0x000001633A4F2000-memory.dmp
memory/4676-21-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-19-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-35-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-37-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-33-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-31-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-27-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-29-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-25-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-17-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-24-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-15-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-13-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-11-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-9-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-7-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-5-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-4-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-47-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-55-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-57-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-67-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-77-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-93-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-91-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-89-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-87-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-85-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-83-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-81-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-79-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-75-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-73-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-71-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-69-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-65-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-63-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-61-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-59-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-53-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-51-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-49-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-45-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-43-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-41-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-39-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-97-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-99-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-95-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-113-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-111-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-109-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-107-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-129-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-127-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-125-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-123-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-121-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-119-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-117-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-116-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-105-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-103-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-101-0x000001633A000000-0x000001633A4F0000-memory.dmp
memory/4676-799-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-801-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-1072-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-4569-0x0000016355770000-0x0000016355D60000-memory.dmp
memory/4676-4570-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-4571-0x00000163399D0000-0x00000163399E0000-memory.dmp
memory/4676-4572-0x0000016355FE0000-0x00000163561F2000-memory.dmp
memory/4676-4573-0x0000016339AE0000-0x0000016339B00000-memory.dmp
memory/4676-4574-0x0000016358AF0000-0x0000016358B18000-memory.dmp
memory/4676-4575-0x000001633A4F0000-0x000001633A4F8000-memory.dmp
memory/4676-4576-0x0000016356330000-0x000001635634E000-memory.dmp
memory/4676-4578-0x0000016358C90000-0x0000016358D52000-memory.dmp
memory/4676-4579-0x0000016358DB0000-0x0000016358DBA000-memory.dmp
memory/4676-4581-0x0000016358D80000-0x0000016358D8A000-memory.dmp
memory/4676-4580-0x0000016358D60000-0x0000016358D7A000-memory.dmp
memory/4676-4582-0x0000016358D90000-0x0000016358D98000-memory.dmp
memory/4676-4583-0x0000016358D50000-0x0000016358D5A000-memory.dmp
memory/4676-4584-0x0000016358DC0000-0x0000016358DD8000-memory.dmp