a6defaa64d14c3998cd050dd467de4cf267b468bb3f646cec14ad7471b95b7a3

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 06:02

Target
2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
Size 236KB
Sample260807-grw9psgr3t
SHA256 a6defaa64d14c3998cd050dd467de4cf267b468bb3f646cec14ad7471b95b7a3
MD5 3fe216d1b654dad83c3d50872d9cefee
SHA1 a6807847d1775da0e4cb18327423770231364624
SHA512 96655be75a75d5a0a7af621c28469af4f889eea3d72130db2cf8f6730fb1b7dd75d5e47d4e7adebcc596eed3b067733e66e235728a94cc14dd163881c7636092
SSDEEP 3072:l9WCHNuBLrilPjWoyqsD+zybpYs2OoaCmnhsZfs3C:l9jOril76QcLV2
TLSH
T1E8347D1362EC3CE6D03A9274B7BB43C1E72EEC6557A1C69E02D002A59E7E1937D267D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

Inhibit System Recovery

pid	Process
1748	bcdedit.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiSkid = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSkid = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
5564	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2728	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3828	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 5564	3828	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe	89
PID 3828 wrote to memory of 1748	3828	2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "AntiSkid" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe" /sc onstart /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5564
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-07_3fe216d1b654dad83c3d50872d9cefee_cobalt-strike_icedid_satacom_stealc.exe
1⤵
PID:3016