Analysis
- max time kernel
164s - max time network
167s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 22:45
General
- Target 2026-07-30_08dd098116278d44e4a8b1a7943efe60_cobalt-strike_icedid.exe
- Size 700KB
- Sample260730-2pdd2agm9s
- SHA256 c848d8ec8f9304466f206cfbe4d4ece7fa0584dfe706f0fd8240c18730606efb
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_08dd098116278d44e4a8b1a7943efe60_cobalt-strike_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_08dd098116278d44e4a8b1a7943efe60_cobalt-strike_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E596AEF.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E596A3D.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_08dd098116278d44e4a8b1a7943efe60_cobalt-strike_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-07-30_08dd098116278d44e4a8b1a7943efe60_cobalt-strike_icedid.exe1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E597E2B.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E597E49.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
~st0E596A3D.xml
~st0E596AEF.xml
~st0E597E49.xml
memory/928-15-0x000001D94BF50000-0x000001D94BF51000-memory.dmp
memory/928-13-0x000001D94BF30000-0x000001D94BF31000-memory.dmp
memory/928-23-0x000001D94BFD0000-0x000001D94BFD1000-memory.dmp
memory/928-24-0x00000001E0000000-0x00000001E0400000-memory.dmp
memory/928-22-0x000001D94BFC0000-0x000001D94BFC1000-memory.dmp
memory/928-21-0x000001D94BFB0000-0x000001D94BFB1000-memory.dmp
memory/928-20-0x000001D94BFA0000-0x000001D94BFA1000-memory.dmp
memory/928-17-0x000001D94BF70000-0x000001D94BF71000-memory.dmp
memory/928-16-0x000001D94BF60000-0x000001D94BF61000-memory.dmp
memory/928-9-0x000001D94BEF0000-0x000001D94BEF1000-memory.dmp
memory/928-14-0x000001D94BF40000-0x000001D94BF41000-memory.dmp
memory/928-8-0x000001D94BEE0000-0x000001D94BEE1000-memory.dmp
memory/928-11-0x000001D94BF10000-0x000001D94BF11000-memory.dmp
memory/928-7-0x000001D94BEC0000-0x000001D94BEC1000-memory.dmp
memory/928-6-0x000001D94BEB0000-0x000001D94BEB1000-memory.dmp
memory/928-5-0x000001D94BEA0000-0x000001D94BEA1000-memory.dmp
memory/928-19-0x000001D94BF90000-0x000001D94BF91000-memory.dmp
memory/928-18-0x000001D94BF80000-0x000001D94BF81000-memory.dmp
memory/928-12-0x000001D94BF20000-0x000001D94BF21000-memory.dmp
memory/928-10-0x000001D94BF00000-0x000001D94BF01000-memory.dmp
memory/928-4-0x000001D94BE90000-0x000001D94BE91000-memory.dmp