9d88986bf8d0def8b28cad2a027e3ec0e03cac1d1ce9408a023e0ad3ea22745a

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc.exe
Size 278KB
Sample260804-jddljsfc74
SHA256 9d88986bf8d0def8b28cad2a027e3ec0e03cac1d1ce9408a023e0ad3ea22745a
MD5 429751ea98b7fe269ba6edaf9e5b1215
SHA1 b692d5562a593aefbf3ca3b1cbded861d83d3185
SHA512 1e614a9937a70a50640f6b7fba35fc242e9fc05a6461c76ecbf97337dd260e647b524abf1c9d492124e17905c585626bb6c304a712a782c5ae1d6627e9759de4
SSDEEP 3072:c3Xrk72zqojJcBZ72mcfmm3RJxhrdgijBGdSREIgVHfXRsDExPcLMuKpV6wPVXxC:SXrk7iHjJFppbjBeylSKD5sdms2
TLSH
T17E546C26B7A418FDE9A7C17DC9424902EB72BC464361EADF03E04AA71F176D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1864	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdateSvc\\svchost.exe"	2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Service = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdateSvc\\svchost.exe"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
PID:4300

C:\Users\Admin\AppData\Roaming\WindowsUpdateSvc\svchost.exe
C:\Users\Admin\AppData\Roaming\WindowsUpdateSvc\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsUpdateSvc\svchost.exe
Size 278KB
SHA256 9d88986bf8d0def8b28cad2a027e3ec0e03cac1d1ce9408a023e0ad3ea22745a
MD5 429751ea98b7fe269ba6edaf9e5b1215
SHA1 b692d5562a593aefbf3ca3b1cbded861d83d3185
SHA512 1e614a9937a70a50640f6b7fba35fc242e9fc05a6461c76ecbf97337dd260e647b524abf1c9d492124e17905c585626bb6c304a712a782c5ae1d6627e9759de4
SSDEEP 3072:c3Xrk72zqojJcBZ72mcfmm3RJxhrdgijBGdSREIgVHfXRsDExPcLMuKpV6wPVXxC:SXrk7iHjJFppbjBeylSKD5sdms2
TLSH
T17E546C26B7A418FDE9A7C17DC9424902EB72BC464361EADF03E04AA71F176D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads