Analysis
- max time kernel
179s - max time network
183s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 00:57
General
- Target 2026-08-04_507750e3dff1a6c533d4d083e7332b6e_cobalt-strike_hijackloader_icedid.exe
- Size 422KB
- Sample260805-bbcbpsvdqg
- SHA256 f68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848ca
Malware Config
Extracted
-
remus_stealer
-
http://slyfogx.shop:5776
-
http://onesdto.shop:2535
-
http://azurhay.shop:8539
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_507750e3dff1a6c533d4d083e7332b6e_cobalt-strike_hijackloader_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_507750e3dff1a6c533d4d083e7332b6e_cobalt-strike_hijackloader_icedid.exe"1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A0992.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A0907.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_507750e3dff1a6c533d4d083e7332b6e_cobalt-strike_hijackloader_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_507750e3dff1a6c533d4d083e7332b6e_cobalt-strike_hijackloader_icedid.exe1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A38F4.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A389A.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
~st0E5A0907.xml
~st0E5A0992.xml
~st0E5A389A.xml
memory/6116-14-0x000002525AA70000-0x000002525AA71000-memory.dmp
memory/6116-12-0x000002525AA50000-0x000002525AA51000-memory.dmp
memory/6116-22-0x000002525AAF0000-0x000002525AAF1000-memory.dmp
memory/6116-21-0x000002525AAE0000-0x000002525AAE1000-memory.dmp
memory/6116-20-0x000002525AAD0000-0x000002525AAD1000-memory.dmp
memory/6116-19-0x000002525AAC0000-0x000002525AAC1000-memory.dmp
memory/6116-18-0x000002525AAB0000-0x000002525AAB1000-memory.dmp
memory/6116-17-0x000002525AAA0000-0x000002525AAA1000-memory.dmp
memory/6116-15-0x000002525AA80000-0x000002525AA81000-memory.dmp
memory/6116-23-0x000002525AB00000-0x000002525AB01000-memory.dmp
memory/6116-13-0x000002525AA60000-0x000002525AA61000-memory.dmp
memory/6116-25-0x0000000140000000-0x0000000140200000-memory.dmp
memory/6116-11-0x000002525AA40000-0x000002525AA41000-memory.dmp
memory/6116-10-0x000002525AA30000-0x000002525AA31000-memory.dmp
memory/6116-9-0x000002525A9D0000-0x000002525A9D1000-memory.dmp
memory/6116-8-0x000002525A9C0000-0x000002525A9C1000-memory.dmp
memory/6116-7-0x000002525A9B0000-0x000002525A9B1000-memory.dmp
memory/6116-6-0x000002525A9A0000-0x000002525A9A1000-memory.dmp
memory/6116-5-0x000002525A960000-0x000002525A961000-memory.dmp
memory/6116-4-0x000002525A950000-0x000002525A951000-memory.dmp
memory/6116-16-0x000002525AA90000-0x000002525AA91000-memory.dmp