Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 02:00
General
- Target 2026-08-03_fee0bb6369672d0cbb8f1c0c343c065e_cobalt-strike_icedid_satacom.exe
- Size 237KB
- Sample260803-cfd7jaaf93
- SHA256 cd41251cd77e50a952069b563617a861f54b981948116eb735421d610dd89ebd
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_fee0bb6369672d0cbb8f1c0c343c065e_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_fee0bb6369672d0cbb8f1c0c343c065e_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SubProcess\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SubProcess\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WinSvcHost\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\WinSvcHost\RuntimeBroker.exe" /wdg 5312 "C:\Users\Admin\AppData\Local\Temp\SubProcess\svchost.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
memory/4120-0-0x00007FFC1513F000-0x00007FFC15140000-memory.dmp
memory/4120-1-0x000002BEE20B0000-0x000002BEE20D8000-memory.dmp
memory/4120-2-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4120-3-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4120-5-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4120-6-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4312-28-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/4312-19-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-14-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-8-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-11-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-12-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-13-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-9-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-15-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-16-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-17-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-10-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-20-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-21-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-22-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-23-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-24-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-25-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-26-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-27-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp
memory/5312-7-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp