Analysis
- max time kernel
148s - max time network
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 08:46
General
- Target 2026-07-12_9ff9b7727ceb85c880c40982f257b812_cobalt-strike_icedid_satacom.exe
- Size 802KB
- Sample260712-kpcn3aez5q
- SHA256 2766240867ec9c3ec7cb06753ccd078aa223067c79b40eda3a3875f5259db19f
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs
- Detects binaries and memory artifacts referencing sandbox product IDs 5 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 5 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_9ff9b7727ceb85c880c40982f257b812_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9ff9b7727ceb85c880c40982f257b812_cobalt-strike_icedid_satacom.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3384-10-0x0000000140000000-0x00000001402F6000-memory.dmp
memory/3384-1-0x0000000140000000-0x00000001402F6000-memory.dmp
memory/3384-11-0x0000000140000000-0x00000001402F6000-memory.dmp
memory/3384-12-0x0000000140000000-0x00000001402F6000-memory.dmp
memory/3384-9-0x0000000140000000-0x00000001402F6000-memory.dmp
memory/3384-25-0x0000018AC0E70000-0x0000018AC0E71000-memory.dmp
memory/3384-21-0x0000018AC0E30000-0x0000018AC0E31000-memory.dmp
memory/3384-26-0x0000018AC0E80000-0x0000018AC0E81000-memory.dmp
memory/3384-22-0x0000018AC0E40000-0x0000018AC0E41000-memory.dmp
memory/3384-20-0x0000018AC0E20000-0x0000018AC0E21000-memory.dmp
memory/3384-19-0x0000018AC0E10000-0x0000018AC0E11000-memory.dmp
memory/3384-18-0x0000018AC0E00000-0x0000018AC0E01000-memory.dmp
memory/3384-17-0x0000018AC0DF0000-0x0000018AC0DF1000-memory.dmp
memory/3384-16-0x0000018AC0DE0000-0x0000018AC0DE1000-memory.dmp
memory/3384-15-0x0000018AC0DD0000-0x0000018AC0DD1000-memory.dmp
memory/3384-24-0x0000018AC0E60000-0x0000018AC0E61000-memory.dmp
memory/3384-23-0x0000018AC0E50000-0x0000018AC0E51000-memory.dmp
memory/3384-14-0x0000018AC0DC0000-0x0000018AC0DC1000-memory.dmp