Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 05:54
General
- Target 2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar.exe
- Size 448KB
- Sample260804-gl43csdh89
- SHA256 6817f92096195e28fe62599eccdd425a58555ef5a01c3783a6f101cc0e0f6656
Malware Config
Signatures
- Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Detects Rhadamanthys Loader v4.9 and higher 2 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2468-13-0x00007FF827A60000-0x00007FF827CC3000-memory.dmp
memory/2468-23-0x000001AB05560000-0x000001AB05960000-memory.dmp
memory/2468-17-0x000001AB05D60000-0x000001AB05D97000-memory.dmp
memory/2468-12-0x000001AB05560000-0x000001AB05960000-memory.dmp
memory/2468-14-0x00007FF826110000-0x00007FF8261D7000-memory.dmp
memory/2468-8-0x000001AB053A0000-0x000001AB053AA000-memory.dmp
memory/2468-15-0x000001AB05560000-0x000001AB05960000-memory.dmp
memory/2468-11-0x000001AB05560000-0x000001AB05960000-memory.dmp
memory/2468-16-0x00007FF825470000-0x00007FF825811000-memory.dmp
memory/4608-4-0x00007FF827A60000-0x00007FF827CC3000-memory.dmp
memory/4608-2-0x0000013BDA270000-0x0000013BDA670000-memory.dmp
memory/4608-5-0x00007FF826110000-0x00007FF8261D7000-memory.dmp
memory/4608-7-0x00007FF825470000-0x00007FF825811000-memory.dmp
memory/4608-10-0x00007FF747730000-0x00007FF7477B6000-memory.dmp
memory/4608-0-0x00007FF747730000-0x00007FF7477B6000-memory.dmp
memory/4608-6-0x0000013BDA270000-0x0000013BDA670000-memory.dmp
memory/4608-1-0x0000013BDA270000-0x0000013BDA670000-memory.dmp
memory/4608-3-0x0000013BDA270000-0x0000013BDA670000-memory.dmp