7d2e3ebeac9e0e68539d4a92347eb9a323bdab32fdb819fbc6c59461f2286c40

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:03

Target
2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 451KB
Sample260808-wnderasclb
SHA256 7d2e3ebeac9e0e68539d4a92347eb9a323bdab32fdb819fbc6c59461f2286c40
MD5 35cafdaa69d75b396263b2b61c905b09
SHA1 503aced1e73a90560f795c03f0c4cc2b08666286
SHA512 c488b9de230e5e30129a034b05d6dac863a084ec895efa1f863c23b8bb60b59e0be7fa81dbdb1265dbbd9a9d2fe94168299b2c06827b93de92d2075e5e0970e4
SSDEEP 6144:CdFkbO9If+K3rFe/D4hEyUjvs5OkxyWo2OVz1/:Nck3rFe/TyUQ5Ok4Z
TLSH
T181A41A053247C8B5E82A6D3CAAA348F2D3B57D15575CD68B1360B63F4E731A88D3B6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	3724	2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\ndumon.sys	2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe
File created	C:\Windows\System32\drivers\config.dat	2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5496	sc.exe
1288	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
916	cmd.exe
5792	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe
3724	2026-08-08_35cafdaa69d75b396263b2b61c905b09_cobalt-strike_icedid_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 5496	916	cmd.exe	91
PID 5792 wrote to memory of 1288	5792	cmd.exe	94

C:\Windows\system32\cmd.exe
cmd /c sc create ndumon binPath= "C:\Windows\System32\drivers\ndumon.sys" type= filesys start= auto
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System32\sc.exe
  sc create ndumon binPath= "C:\Windows\System32\drivers\ndumon.sys" type= filesys start= auto
  2⤵
  - Launches sc.exe
  PID:5496

C:\Windows\system32\cmd.exe
cmd /c sc start ndumon
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\System32\sc.exe
  sc start ndumon
  2⤵
  - Launches sc.exe
  PID:1288