c904da62bec24734a5e7e89f9509a46c21f3f3979788443826126de12e54c89f

Analysis

max time kernel
3s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-07_e184b2be59023739a63c68ed76395b8c_cobalt-strike_icedid_satacom_stealc.exe
Size 231KB
Sample260707-hp2xvaby9v
SHA256 c904da62bec24734a5e7e89f9509a46c21f3f3979788443826126de12e54c89f
MD5 e184b2be59023739a63c68ed76395b8c
SHA1 a0c742ed1af9812d816080cce86c54d45479adc0
SHA512 9253a78d2af7d021f7bed5be6889f489c4036c385b27c1378288175fc4c1aa69070d79fe43599ae7343f30f31ab64de5732d13a1402ed96dc8899f7e70d57b34
SSDEEP 3072:2CmBKHojRS2VtiWrb4mCb5q/yPEvCOXEcnSiw+k20W7Wnc3JOWk/sKrDAOheRE:2Ck1Sw/CbKyMvdBhNmcI38E
TLSH
T1D1348D15B7A50CFAE6B78579C9424901DB72BC5247A1EBCF03A00A979F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\null = "\"C:\\Users\\Admin\\AppData\\Roaming\\shdwn.bat\""	2026-07-07_e184b2be59023739a63c68ed76395b8c_cobalt-strike_icedid_satacom_stealc.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4000	shutdown.exe
Token: SeRemoteShutdownPrivilege	4000	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5632	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1628	2544	2026-07-07_e184b2be59023739a63c68ed76395b8c_cobalt-strike_icedid_satacom_stealc.exe	88
PID 1628 wrote to memory of 2668	1628	cmd.exe	89
PID 2668 wrote to memory of 4000	2668	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-07_e184b2be59023739a63c68ed76395b8c_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_e184b2be59023739a63c68ed76395b8c_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /C "C:\Users\Admin\AppData\Roaming\shdwn.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\cmd.exe
    cmd.exe /C "C:\Users\Admin\AppData\Roaming\shdwn.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /f /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4000

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0c855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shdwn.bat

Path C:\Users\Admin\AppData\Roaming\shdwn.bat
Size 19B
SHA256 3940156a4d1d3256897d2f22b8c5c124b3bf6f7b221290baca678ed9db4e2261
MD5 223ab3c112c92c89308779db02fdcc7e
SHA1 e011a699be0b4f37c5415e385e3e212723b68082
SHA512 92dfbef22db392e58d3f92938b7fc3f9f06735ce1159e3d5f6b37d53e818e94dcb62b510bd671f1c33470cd72838e7828cd38e3abadb81b37dc6829b0ee4ac4c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads