a6defaa64d14c3998cd050dd467de4cf267b468bb3f646cec14ad7471b95b7a3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 06:02

Target
2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
Size 236KB
Sample260807-grw9psgr3t
SHA256 a6defaa64d14c3998cd050dd467de4cf267b468bb3f646cec14ad7471b95b7a3
MD5 3fe216d1b654dad83c3d50872d9cefee
SHA1 a6807847d1775da0e4cb18327423770231364624
SHA512 96655be75a75d5a0a7af621c28469af4f889eea3d72130db2cf8f6730fb1b7dd75d5e47d4e7adebcc596eed3b067733e66e235728a94cc14dd163881c7636092
SSDEEP 3072:l9WCHNuBLrilPjWoyqsD+zybpYs2OoaCmnhsZfs3C:l9jOril76QcLV2
TLSH
T1E8347D1362EC3CE6D03A9274B7BB43C1E72EEC6557A1C69E02D002A59E7E1937D267D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

Inhibit System Recovery

pid	Process
2780	bcdedit.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSkid = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSkid = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3880	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3880	1224	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe	85
PID 1224 wrote to memory of 2780	1224	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "AntiSkid" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe" /sc onstart /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3880
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x324
1⤵
PID:3204

C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
1⤵
PID:552