Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 154KB
- Sample260704-sms72acy3l
- SHA256 196b1fb0a94f973d958f6f3ba7df86bfb0cc450d481fb4186785af95b79301ce
- MD5 72d90b7f654a00a543189c08711b6847
- SHA1 e0f0b17eb88cc9ce280345586468de5fc402fd83
- SHA512 da6934f266e45606880b9deb1755de4a98e4c433641c5d46fd9948aa4fe6d21b0089f4d8692f844629977b8188de617bfbeef71831371056de51071bd13e7491
- SSDEEP 3072:tpZqBasQBAW1x7OFr9h8OHqe+O9/NzHcCfBBQ5HY:tpABtCAW1x7OFPvb+O9/9BW4
- TLSH T1C9F3294772E421F9F177923888925A45F776B8314B20DBBF07A4477A1F23A809E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.grx\PreviewDetails = "prop:System.FileDescription;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateCreated;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\.lsp\ = "enjiCADLISPFile" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\Shell\open\command 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\shellex\PropertySheetHandlers 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.grx\ = "enjiCADExtensionFile" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\shellex\PropertySheetHandlers\Digital Signatures\ = "{22391867-2469-4DEC-8091-901A5AA1EF12}" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dcl 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.grx\TitleInfo = "prop:System.FileVersion;System.FileDescription" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\DefaultIcon\ = "\\gcadres.dll,3" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.grx 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.grx\FullDetails = "prop:System.PropGroup.Description;System.FileDescription;System.ItemType;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\DefaultIcon 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADExtensionFile\DefaultIcon\ = "\\gcadres.dll,0" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gdx 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\Shell\open 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gdx\FullDetails = "prop:System.PropGroup.Description;System.FileDescription;System.ItemType;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADHeidiDeviceInterfaceFile\DefaultIcon\ = "\\gcadres.dll,1" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dbx\InfoTip = "prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\DefaultIcon\ = "\\gcadres.dll,4" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\ = "enjiCADLISP Application Source Code" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\Shell\open\command\ = "C:\\Windows\\system32\\notepad.exe \"%1\"" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gdx\InfoTip = "prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dbx\TitleInfo = "prop:System.FileVersion;System.FileDescription" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADCoreExtensionFile\DefaultIcon 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.grx\InfoTip = "prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDatabaseExtensionFile 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dbx 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\Shell\open 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\Shell 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hdi\InfoTip = "prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hdi\FullDetails = "prop:System.PropGroup.Description;System.FileDescription;System.ItemType;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hdi\PreviewDetails = "prop:System.FileDescription;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateCreated;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dbx\FullDetails = "prop:System.PropGroup.Description;System.FileDescription;System.ItemType;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\.lsp 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADHeidiDeviceInterfaceFile 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADHeidiDeviceInterfaceFile\DefaultIcon 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDatabaseExtensionFile\DefaultIcon\ = "\\gcadres.dll,2" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.grx 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdi 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdi\ = "enjiCADHeidiDeviceInterfaceFile" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dbx\ = "enjiCADDatabaseExtensionFile" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\DefaultIcon 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\shellex\PropertySheetHandlers\Digital Signatures 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gdx\ = "enjiCADCoreExtensionFile" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gdx\TitleInfo = "prop:System.FileVersion;System.FileDescription" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADExtensionFile 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDatabaseExtensionFile\ = "enjiCAD Database Extensions" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dbx\PreviewDetails = "prop:System.FileDescription;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateCreated;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dcl\ = "enjiCADDialogDefinition" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\Shell\open\command 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADCoreExtensionFile\DefaultIcon\ 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\Shell 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADLISPFile\shellex 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\ = "enjiCAD Dialog Definition" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADDialogDefinition\Shell\open\command\ = "C:\\Windows\\system32\\notepad.exe \"%1\"" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADCoreExtensionFile 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gdx\PreviewDetails = "prop:System.FileDescription;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateCreated;System.DateModified;System.Language;*System.Trademarks" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADExtensionFile\ = "enjiCAD Runtime Extensions" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\enjiCADHeidiDeviceInterfaceFile\ = "Device Interface Files" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hdi 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hdi\TitleInfo = "prop:System.FileVersion;System.FileDescription" 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dbx 2026-07-04_72d90b7f654a00a543189c08711b6847_cobalt-strike_icedid_satacom_stealc_vidar.exe