f7354f963affacf4059f30ff7ee674adab305213eded227f4bf54021a8e5a95f

General

Target
2026-07-22_83f0cbc7a29cc5245315b13bd049388a_cobalt-strike_icedid_stealc.exe
Size 402KB
Sample260722-3m3ftaaq4v
SHA256 f7354f963affacf4059f30ff7ee674adab305213eded227f4bf54021a8e5a95f
MD5 83f0cbc7a29cc5245315b13bd049388a
SHA1 3bd5ba100a8e2f6c64442f159b33a1516e5316ee
SHA512 4304559e014fcd2174ea6f2d30e97fb52358c344dda717683708095cbb2f3ffb213ab9edc2e333de11b75bbec29fa32430e52f63131298e4a954f8867b0811cf
SSDEEP 3072:AtAnPxAm6lAOKOdH7+Yg7Jl0jwEx7cDnLpkQQLCLj01ElwL40hNPj76OfsIaPb4j:AK96zg7nawEKL+9G2L1WOKPosUq72l
TLSH
T1B094C5C66B72CE7BF94D70F5C425E462CD1CBD610FA2F6874AF4759A09339604F282A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5020	abcdefg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\IndexerSearchSystemService = "C:\\Users\\Admin\\AppData\\Local\\xyczactdeug\\abcdefg.exe"	2026-07-22_83f0cbc7a29cc5245315b13bd049388a_cobalt-strike_icedid_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\IndexerSearchSystemService = "C:\\Users\\Admin\\AppData\\Local\\xyczactdeug\\abcdefg.exe"	abcdefg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Documents\malware_analysis_result.txt:hidden_data	2026-07-22_83f0cbc7a29cc5245315b13bd049388a_cobalt-strike_icedid_stealc.exe
File created	C:\Users\Admin\Documents\malware_analysis_result.txt:hidden_data	abcdefg.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_83f0cbc7a29cc5245315b13bd049388a_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_83f0cbc7a29cc5245315b13bd049388a_cobalt-strike_icedid_stealc.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
PID:3732

C:\Users\Admin\AppData\Local\xyczactdeug\abcdefg.exe
C:\Users\Admin\AppData\Local\xyczactdeug\abcdefg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59D76868C250B3240414CE3EFBB12518_EF9B09A6703C9EBB1C1B622C277FBED8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_EF9B09A6703C9EBB1C1B622C277FBED8
Size 471B
SHA256 bc53e4ae0105022b20b84274fdee3bb0fa1df128da6535e79217f3ee5956b6e3
MD5 8aefdccdcb6e16b4ee495fb07e21da7d
SHA1 ce1425ef93e72c45e6d930230d3794bff51fa3dc
SHA512 534b8e5126f4f09e4f05acef1f4628384c6ed2615a5f5447352df4076036a344bd2f5c6483465e1408a0a26adf9b8750516df913248edc1fcbbf3fac28b7ed88
TLSH
T1FBF0DC674154A8A1BD629C5D23CC57BF3CB6508861C6E86919F8008620203EBF76D2A8
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 471B
SHA256 b29bdb5f90a3744446c1391be8134415f4efe8d0858ac153ee66af27c87af287
MD5 47848985fbeacb2b61ce20679c458abb
SHA1 267b3613fa7a2e13d1771f062fc5360f68afef68
SHA512 bbe29ebf4013a26be14a4a07160c8eb422775564b7c105b2ab8eb3a0568e4d7f6b42328e5e06d7bc807149ceb2c3407531ba7a5b0df7db872b70ddfaa6e7724d
TLSH
T167F0D447495FE8C00D471BDC41C221BEB43453534C4645C1547484B6494EABF715A431
MD5 SHA1 SHA512 TLSH

Submit Download

59D76868C250B3240414CE3EFBB12518_EF9B09A6703C9EBB1C1B622C277FBED8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_EF9B09A6703C9EBB1C1B622C277FBED8
Size 400B
SHA256 56609647eab2dc6ebcb433afbd5a41fe7df88fade10334986cebe661e897087b
MD5 27a746ecfb5ff5e5b700acc3623becff
SHA1 5ee77e976b667269c00d445b6332aea00cc918ac
SHA512 e6b016c3296770af24b06e1efe73da00c1e4aaffba798839787c84d500dafa8ce11fe8d812cc19d6516399e7c3c98d1cdfb6944a47c2ecfb4b9fda8bdd479f47
TLSH
T1F2E0C03026F45828E2E0D2300BD091D419B8FC0678154FE91D961209AA0AA004C43535
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 688c163454928c5920f457875713c3340d8a3c5d781a9d1e11e8bc1f266820bd
MD5 4a252fdad6c8fa00496ae2f9c6c2a11c
SHA1 b9be1015680396dc152829104f0e0d6bf57db51d
SHA512 218cfa8c3bc5a1f56ea8c6b16051497cdfd4ed26b88359d8ebf4468adbd6bd5dfa4a73bc71f1d646ca96c97f04aaf902db2f694a035d9cbe0dd2242a0842bf3a
TLSH
T1EEE0C01013FB806CF5E4C1398BE57D3146A9F0711428B2BA1BE117046703600EC81975
MD5 SHA1 SHA512 TLSH

Submit Download

eolbrowser[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8PCNG0VN\eolbrowser[1].htm
Size 2KB
SHA256 8ccf0838155cad4f19c90b711db3c2833d03e26f766cb1937fdeae96da62244c
MD5 f221cead204d87e2b0bddf4588c089f3
SHA1 fbf0a70140948751431964595bac1e4b55cc10bb
SHA512 ac63e319cb8993d7ebb2af33866f1de46b4add1799986cbc458a2f9bf2323df0a40111e47077334e6849a036b29fe4758b436f770d5de1fa971e6a3ab1fec1f9
TLSH
T11141220EC58624017473627D6BB3534AFB4640F7838285A57FEC23268FB6418C2A3F8C
MD5 SHA1 SHA512 TLSH

Submit Download

abcdefg.exe

Path C:\Users\Admin\AppData\Local\xyczactdeug\abcdefg.exe
Size 402KB
SHA256 f7354f963affacf4059f30ff7ee674adab305213eded227f4bf54021a8e5a95f
MD5 83f0cbc7a29cc5245315b13bd049388a
SHA1 3bd5ba100a8e2f6c64442f159b33a1516e5316ee
SHA512 4304559e014fcd2174ea6f2d30e97fb52358c344dda717683708095cbb2f3ffb213ab9edc2e333de11b75bbec29fa32430e52f63131298e4a954f8867b0811cf
SSDEEP 3072:AtAnPxAm6lAOKOdH7+Yg7Jl0jwEx7cDnLpkQQLCLj01ElwL40hNPj76OfsIaPb4j:AK96zg7nawEKL+9G2L1WOKPosUq72l
TLSH
T1B094C5C66B72CE7BF94D70F5C425E462CD1CBD610FA2F6874AF4759A09339604F282A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Munkahelyi Anyagok.lnk

Path C:\Users\Admin\Desktop\Munkahelyi Anyagok.lnk
Size 1KB
SHA256 1882f1d61b373ecf5b1107cea9dfba6564a4d7c57ea270e521943fb4d5796b10
MD5 6b3b79b23b6d77e50cfa2a03e91b4388
SHA1 52c1b0001bb3715293ac1dd779da122931c0ad19
SHA512 7b6bbeb4345cb33ba1578005e0cd1f986f97c5f2f05b6e221bc83d94111bb3106ff957c651beb022ac3c0015cc706bf6cd3c76a661f5b03619130469bd184071
TLSH
T19121BD0259860A15C1FB813B96F77356DA2AF811B6A69E6C4011F35E1E31B815E48F2E
MD5 SHA1 SHA512 TLSH

Submit Download

malware_analysis_result.txt

Path C:\Users\Admin\Documents\malware_analysis_result.txt
Size 259B
SHA256 cdbcc4d262d555a25cf9e4a0e45236c2f4b24e86176b312583abb0ad494ff303
MD5 bd65bb0fa98136c84d1b94d18ef18cc0
SHA1 8d2a1d8aeffd7de70469ca45aa20102793f38df9
SHA512 d1fbb5943e198ae88ca6761e94af68a53c67798d472e6cd2efa72eeba9fdb17d9dee30efbbdd89d12df62b8f803cb3be44afee0443cd4cc1707f6b509b965452
TLSH
T11ED02B905270626E80B78380244DD3885D7B09D6A11257AC700CA55D7C196B4628AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads