cadad02d48ac1dda953679290033dac78ef4b268440979b1be24a3e861b3db6d

General

Target
2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe
Size 260KB
Sample260804-jpdexsfe87
SHA256 cadad02d48ac1dda953679290033dac78ef4b268440979b1be24a3e861b3db6d
MD5 30f3e2962d9b956a1e05c3e2c52bde5c
SHA1 0c1adf5c8b8e069c42844ea47f3321f09aabf29e
SHA512 84d2e5e51d1b8ad49abf691814b5419a6b60ed49f650728b6c2086b056b7833799c222deea3329d5a8cf89749b70a327cca9dc28644fa93f86190d10ef54f6d7
SSDEEP 3072:VojtiAvJxL+zdswanUIJbeubA+ckR8zo/ds8SUGnQpzi4WLkGcM99cw7pestKB2E:S59qzAUIJbe2Xmz4duUyLcqGV
TLSH
T1CB447C16BB641CFDED6B817DC9424A06EB72BC564761E6CF03A04A970F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Helper Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Helper Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

C:\Users\Admin\AppData\Local\Temp\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
PID:3644

C:\Users\Admin\AppData\Local\Temp\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc.exe
1⤵
- Adds Run key to start application
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chrome_Cookies.db

Path C:\Users\Admin\AppData\Local\Temp\Chrome_Cookies.db
Size 20KB
SHA256 79265a3e366b324e74163601894656ba06514b58574febab32d760296a85fb09
MD5 af51479c33a949e999808f130c17d2db
SHA1 e0e13518cd31fa8ea282c48e36df0bd7e584f58d
SHA512 1e64997cdf39b71a33fc22deecc21b8af09eec3d95532fb362fab8a124f1dc956c3739b28d2e9dc1dff1c8ed4174c9351a73fbf0a203344582028bf8af66a820
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5d74p8DWr8/fe6jHyj:TeW9aw/aHLopFMavU1iBQNHOpv8nnjHE
TLSH
T1E392CF4F1F343224C4F88776E9D2099B1D7C112C93276BD9EE5418B29D9259FB1060E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_History.db

Path C:\Users\Admin\AppData\Local\Temp\Chrome_History.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot.png
Size 616KB
SHA256 583ae48738dc83295cc41350f2e514637aa01a3c2f1cb486488ae200417fa16e
MD5 f14c7fed613da61d803bd40fdc782854
SHA1 4902f025f5fe875be5da1efdc3618175e563f6ea
SHA512 cd247fbe272ba931d7086f6e1cb7c407de1c6102d34776f3467a24d474399c2b6d5f6d9ef42812640ec2efd4f57a11e8508590fd2f6d2c6635aba88312e7726e
SSDEEP 12288:27g4a8lih56CQTQ453SWMaYM8aHWlqf8dzzTvWRGfQ9wSzrlGdK+:27gP8lw6T53SuxHTsvWRGI9wkj+
TLSH
T126D423A971E8C16ECC9F4C7FFDC02A5F7E967464C9AF8E34A230DC824142D896E61356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winupdate.log

Path C:\Users\Admin\AppData\Local\Temp\winupdate.log
Size 735B
SHA256 c99b66b8a3df53c959babe85782596568ca7f0225f4119815dad0d9b0e3b05c0
MD5 ccc532caffae8703a99f421eea60a0f1
SHA1 456c07d6808cbe48fb1af220be950548547b8443
SHA512 67aec92921b2acafd4418e7f24213394b9d9303ba0564877cd55b1589d174a3c9563cfc5580bf51bd28b08fcd4f62d29bf10f0bbd5724c036103a10af7de512b
TLSH
T11B01440324EE65AB0942526F9031AFDC9267F8939F007A16E7AC94123CD1D3F5EA3D1A
MD5 SHA1 SHA512 TLSH

Submit Download

winupdate.log

Path C:\Users\Admin\AppData\Local\Temp\winupdate.log
Size 430B
SHA256 19d257b3fc89194729739540246a78859e41d9c09f899d43204808511acc0faf
MD5 82f1b7d34ef98cfdd2e92fec32f484b7
SHA1 f3c6405acaa5e79c2d1ab3863d488e1d591051cc
SHA512 8b6462a5523990070fa57981699436d86dcb56936c61ac480b747ae6d6ebfe2930bb9dc49e06a2f448131245de30065f3b3368eccdc4f991ea18e668697b3515
TLSH
T123E0C00324FEA59F0952526F91316FDC9162F8935F006617A7AC881239D1C3E5DA3C16
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads