Analysis
- max time kernel
148s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 04:25
General
- Target 2026-07-08_88fa4a305dedf4eaa48f4800316d2dd7_cobalt-strike_icedid_satacom_stealc_vidar.exe
- Size 2.0MB
- Sample260708-e2dh8sbv7r
- SHA256 96aedea48a59683d772a62c9eaaaa7a8d42ace01360efef2d81f602dc5a35a06
Malware Config
Signatures
- Detects executables manipulated with Fody 64 IoCs
- Detects executables packed with unregistered version of .NET Reactor 64 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_88fa4a305dedf4eaa48f4800316d2dd7_cobalt-strike_icedid_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_88fa4a305dedf4eaa48f4800316d2dd7_cobalt-strike_icedid_satacom_stealc_vidar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5564-1-0x00000297AA730000-0x00000297AA91A000-memory.dmp
memory/5564-0-0x00007FFDB54BF000-0x00007FFDB54C0000-memory.dmp
memory/5564-2-0x0000029791D60000-0x0000029791F46000-memory.dmp
memory/5564-3-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-5-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-27-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-25-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-72-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-67-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-65-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-84-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-90-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-63-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-53-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-112-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-82-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-80-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-78-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-110-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-108-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-126-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-122-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-106-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-104-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-118-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-116-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-114-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-131-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-128-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-124-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-120-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-102-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-100-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-99-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-96-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-95-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-93-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-89-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-86-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-76-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-74-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-71-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-51-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-49-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-47-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-45-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-43-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-39-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-69-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-61-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-59-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-57-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-55-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-41-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-37-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-35-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-33-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-31-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-312-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-29-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-17-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-15-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-9-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-23-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-21-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-19-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-13-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-11-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-7-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-4-0x0000029791D60000-0x0000029791F42000-memory.dmp
memory/5564-1204-0x00000297917F0000-0x0000029791802000-memory.dmp
memory/5564-1205-0x00000297918F0000-0x000002979192C000-memory.dmp
memory/5564-1206-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-1208-0x0000029791B20000-0x0000029791B5E000-memory.dmp
memory/5564-1209-0x00000297919A0000-0x00000297919AE000-memory.dmp
memory/5564-1207-0x0000029791990000-0x0000029791998000-memory.dmp
memory/5564-1211-0x0000029791AE0000-0x0000029791AFE000-memory.dmp
memory/5564-1212-0x00000297ABA40000-0x00000297ABAF4000-memory.dmp
memory/5564-1210-0x00000297AB7D0000-0x00000297AB916000-memory.dmp
memory/5564-1213-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-1214-0x00000297B00C0000-0x00000297B00D8000-memory.dmp
memory/5564-1215-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-1216-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-1217-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp
memory/5564-1218-0x00007FFDB5330000-0x00007FFDB5CD4000-memory.dmp