7ca3e2592b3c1f7c3c6087c6c729db697b301efa190fcb72ce9ea8316885b18a

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0a8e2a9ab0a2a1cd34899e7548417e64_cobalt-strike_icedid_satacom.exe
Size 708KB
Sample260723-grhrbaha68
SHA256 7ca3e2592b3c1f7c3c6087c6c729db697b301efa190fcb72ce9ea8316885b18a
MD5 0a8e2a9ab0a2a1cd34899e7548417e64
SHA1 1edea0a05430ed76007fc608f6613f721013373a
SHA512 5dfd5b783c3f15506a267171c7c5b180bbfaca64909e6f3c824f35a6d737c29c52f63b0ed2ab9a02844ec657bc74494fcb8215357294ef02eca31fbe7f0603cf
SSDEEP 12288:YAF9S9RVgeU5IUfJc37u4I/srDJJwHHI6QJnT5kK8/qCRsxDZD66JZ:YAF9Ygd5Ivu4IiFJB77Bb3JZ
TLSH
T141F4F1506F5530B9EE60133B93AA3DE8E27954104F64AADF8BE045FF9E476C0947AE30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c514-11.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
3660	AppHostAssist.exe

Loads dropped DLL 1 IoCs

pid	Process
3660	AppHostAssist.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe
3660	AppHostAssist.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	AppHostAssist.exe
Token: SeDebugPrivilege	3660	AppHostAssist.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3660	1256	2026-07-23_0a8e2a9ab0a2a1cd34899e7548417e64_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0a8e2a9ab0a2a1cd34899e7548417e64_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0a8e2a9ab0a2a1cd34899e7548417e64_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Contoso\AppHost\AppHostAssist.exe
  "C:\Users\Admin\AppData\Local\Contoso\AppHost\AppHostAssist.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d97syluq0mt.dll

Path C:\Users\Admin\AppData\Local\AppHostData\54F84552\2d97syluq0mt.dll
Size 4.5MB
SHA256 58e88d6f51db03e07b64f7dc39da678612108a3189139f0f494f8adc11656b72
MD5 aacff33c25e23a743fc6820e0a60a840
SHA1 b5ae691347e7e67a86d71aa771cc4df298147c02
SHA512 c6a3ef698a0a58919468da56d14c21a245246a5cd7e9dcad6cbd87c41655489e441dd901c59c3457d3e1c0cb9ac772b1dc2078d4b2923457e57c6534483717eb
SSDEEP 49152:iIru4+bNraEaSyhL9eyDrOdpDJayaZ/iM2gGmjQFRbuuHJVVGNQ/oIShXKY1wSjo:i4cwzi1z4UcNEm
TLSH
T11B267D03BF8A4AA9C09DC874C28B4A639B3274DB1A31F6AF41C545253F6B7B16F1D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppHostAssist.exe

Path C:\Users\Admin\AppData\Local\Contoso\AppHost\AppHostAssist.exe
Size 454KB
SHA256 c88af8864c29bebd746475a5b3689a9c983db5517ce5909d95f9c21c053a8825
MD5 1d32b6c211ceda88511670f128deca7a
SHA1 569593c006e039e36b3a9f0e77ba4c8791c9fc30
SHA512 c87167a993ec555be4b271b582dfe857ec3c160bff55157c62ee14dea00e3487c51864dadc2a7e99f767ee3b086dee86fb635254f380690d74f6471071ccd2a1
SSDEEP 6144:k+Gu4CNFJz+wF/gc2yxApD3Hsr0ZQNkouU6XaM1Fx7eubXSowHzyT:kkDGwF/gc2yxAihMzSLzyT
TLSH
T114A46D67E14150ECCC9FC0BA83479B32B53630884F617DEF05A892351E56BF9AB39768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download