0461471996508f524defad24bc1213a6b4c7cdcc2745b8efd9eea7fad0003569

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 533KB
Sample260710-tkvthscw7j
SHA256 0461471996508f524defad24bc1213a6b4c7cdcc2745b8efd9eea7fad0003569
MD5 b7413019f624fabdc98587ce4f313dba
SHA1 d110f5b32fd17da1422ddfcf09a5c1e4c27db85a
SHA512 ef1048abff222c18202cb3106da34a9973d94b35832fe1a8b91b6d2fa1f2f32548802063442351fb2c3a7d0d61d30d1376cb5503a8ba59c8418d27afe1a9f72b
SSDEEP 6144:hdFkbJ9If+N3rFe/D4hEyYs5OkxyWo2OVz6G124CocoiXSyCMIr9Nwd1UY:urf3rFe/Tyj5Ok41coiXSkX1x
TLSH
T13AC44B053147C8B5E82A6D3CAAA348F2D3B57D19575CD68B1360B63F4E771A88D3B2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	3680	2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
5784	chart.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\chart\chart.exe	2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe
File created	C:\Program Files\chart\config.dat	2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chart.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	chart.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3680	2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe
3680	2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe
5784	chart.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5784	chart.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5784	chart.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_b7413019f624fabdc98587ce4f313dba_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3680

C:\Program Files\chart\chart.exe
"C:\Program Files\chart\chart.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chart.exe

Path C:\Program Files\chart\chart.exe
Size 451KB
SHA256 34af4e893055d100e90d657ffc39ba0a9f3531e9ddf1f35269e5f8fcd08129e4
MD5 1e7be155513ba6fb317b0b746ab7ead4
SHA1 f7a9d23b8081da78c4203eb92e4bad039441803b
SHA512 4595e8510b2fefd513e4aac513e00a55b263e26c8c4db00deb75848046863a374023c4289811cc6cd936dba2d0952786c8b9a574f6da17e6a19784d51b04496e
SSDEEP 6144:9dFkbJ9If+WrFe/D4hEyUjvs5OkxyWo2OVz1/:Sr0rFe/TyUQ5Ok4Z
TLSH
T160A419053247C8B5E82A6D3CAAA348F2D3B57D15575CD28B1360B63F4E771A88D3B6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.dat

Path C:\Program Files\chart\config.dat
Size 1.8MB
SHA256 e29c88c6324327e40189d07d4930ccf0183d410d51e6f70234465277d36f21b0
MD5 00234ebd5a0436ef74596d2f3a6776c1
SHA1 7240936ad4dae370241f06c638c4ec9349e0d042
SHA512 4c6f7fe6cc3efc0319172daedf693764c8edae69ebf275c32ce032c1746103705548f3d81b017dd92c593cb67adb4bdd819605a4b81a9c8c80d65b4a9a7bb760
SSDEEP 49152:D1XO9SbprjTpwg2/cjCj69U9ifinGsVOLaVciwIa5rYAuNhK4U:RXO98prn79U9pnzltna5/Uhs
TLSH
T11295338873DD5E323AC565FE6A91EB860C1778E2F1C01FB7A9D34E82DEB35247465208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3680-0-0x0000020F49CE0000-0x0000020F49D00000-memory.dmp

Download

memory/3680-1-0x0000020F49D00000-0x0000020F49D26000-memory.dmp

Download

memory/5784-25-0x000001EA06340000-0x000001EA06341000-memory.dmp

Download

memory/5784-31-0x000001EA07ED0000-0x000001EA0809E000-memory.dmp

Download

memory/5784-26-0x000001EA06330000-0x000001EA06334000-memory.dmp

Download

memory/5784-32-0x000001EA083B0000-0x000001EA086B2000-memory.dmp

Download

memory/5784-33-0x000001EA086C0000-0x000001EA08AC3000-memory.dmp

Download