425ac24ab2ae92b01efa49064a8d49a437432ee6b1116a6b7a812cea7caab2c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8415a7477febcb3e8ac481b932f9e0d9_cobalt-strike_icedid_satacom.exe
Size 2.8MB
Sample260809-tyhfcaaj2x
SHA256 425ac24ab2ae92b01efa49064a8d49a437432ee6b1116a6b7a812cea7caab2c5
MD5 8415a7477febcb3e8ac481b932f9e0d9
SHA1 1e4c05a1441f15b7ab4ed4e646b03852adaa6458
SHA512 7cde6699331e621c062f9a15dd6a3122350ee1e0acd8bb51ab9ea80f19d9ffd43ab36c3bfc57565fb610ac45d36f877463b332641453fefad28603fa894bac73
SSDEEP 49152:oJi7BkbsqMEtgAKEwF4ke07xHxNda8kK5+IIrAp+M3wM24JPeiKFt/4n/OCCCN0n:36bH/tCtF4irNk8lRIrS+zOP3wx4nGC
TLSH
T15FD53349FB9441E8FA32D77A963D2505F83E301507505DEF2A100A547E3ABEE893FB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution spyware stealer

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000242ac-2.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000242ac-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 1 IoCs

pid	Process
3820	upd6BF4.exe

Loads dropped DLL 1 IoCs

pid	Process
4196	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	discord.com
43	discord.com
40	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3820	upd6BF4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4188	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3820	upd6BF4.exe
3820	upd6BF4.exe
4188	powershell.exe
4188	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3820	1584	2026-08-09_8415a7477febcb3e8ac481b932f9e0d9_cobalt-strike_icedid_satacom.exe	88
PID 3820 wrote to memory of 4196	3820	upd6BF4.exe	89
PID 3820 wrote to memory of 4188	3820	upd6BF4.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8415a7477febcb3e8ac481b932f9e0d9_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8415a7477febcb3e8ac481b932f9e0d9_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\upd6BF4.exe
  C:\Users\Admin\AppData\Local\Temp\upd6BF4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Loads dropped DLL
    PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grab_240676078\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\VGXMSUXF_Unknown.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VGXMSUXF_Unknown.zip

Path C:\Users\Admin\AppData\Local\Temp\VGXMSUXF_Unknown.zip
Size 4KB
SHA256 c1b2f6e904718b89181c3a9a2344d68c2400f330121e547aa0021bae0b0d4b0f
MD5 b28861fa693101089478bdbf7e179d82
SHA1 575e32c9f01e03ba27af94d6d1cd51c9be62024d
SHA512 ff18261647f74ded7774b956dd393057d2f75150dd232e71e9d836eeb25f19f398614baf892e6a624df5ef2237e96fccca2266f3a7ce5d88a753f8bd2c449523
SSDEEP 96:3eeq9+Vxg7iPJZ9waD8W+LFQLaYKGaY3g:3eeCEVgWBaYKs3g
TLSH
T1BC917C8D9E1633C6D06EAB3426140F015DEA0F6373F0508395E9DA91B475BCA83B29EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bkidnu52.gpd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bkidnu52.gpd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cex_af_3820.db

Path C:\Users\Admin\AppData\Local\Temp\cex_af_3820.db
Size 138KB
SHA256 efbbb14f16a03c4198dab865482b4ca4cec861113158fbbed7d08245994b0bf9
MD5 812ffb2baed49a420da3c2bf41662565
SHA1 6c4b8df9aa0169d56f8a777b0e4327873c913b91
SHA512 036542d5ce386985a4502b38117e1c73a3bfb6d9146035abdfdb89938c85a8a01e4cb3f2a9c1a64603f3d8a3530a97248d51bf3d40821cad30a536ea238ea0f4
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OeSpX6cq/+dVumkwkb:zeuvBnhJsueMEGvIW1DcP2O50WVumknb
TLSH
T1A9D3874B3A743102EDE69A721CE050BF5E3C716D4F55A5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cex_af_3820.db

Path C:\Users\Admin\AppData\Local\Temp\cex_af_3820.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cex_p.dll

Path C:\Users\Admin\AppData\Local\Temp\cex_p.dll
Size 15KB
SHA256 bc6d9174734adbb01d902ab5f89e3feaed954de05df91f4060c2992607364e3c
MD5 ac233456e13705eec24a5302ca15e4f6
SHA1 fcb9e17fefb0c24bb477c04c312881fa3e04d913
SHA512 38eb4552a1206537fbff87b3e83dd2eb624a3e86153818a552f0c12396fada30a1f1a6249a4305190da9aae6668ccf9c73ce431e5d2f9351c2c0b9657a2f70b6
SSDEEP 192:gT3YooC9S5Fmh4Lyu6rEE59xP8T6UaGCLhjSPZb18sJg96jgs0BQvaM:o3Bz9eFmOXgEER8T6UMLRSbo2Hv
TLSH
T1C0622A07F3A909E9D639813485B34E2AF97BF434037253EF0360952D1E767C27ABA654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cex_payload.bin

Path C:\Users\Admin\AppData\Local\Temp\cex_payload.bin
Size 673B
SHA256 e4ba164fc933178e97811f8edbdd48f7b0092aaa1ec20334c7b95c87274bc910
MD5 26d1a62d3b46f95a0ca44020ac4e7447
SHA1 0cb47ba9baaa9754fdbeaf52cbec07320b39e8b5
SHA512 c48cf05e5d56e6ccf65c7b3ef1394efd3de4917d9ce6ceaa07f10623db2c7edd3c85ab521227ed70129557d5b10d59cca7943148f7c5000996e7b51385c38563
TLSH
T17201888209E45116F147037A3D9169734AFBF9858493D344E6470026151B6650754DF3
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\Chrome\Default\cookies.json
Size 504B
SHA256 11e2638eaf6c38b8fceceaa70622dc17fbabbf28a7b772f91be7ec22a3b5fbf3
MD5 cc9a479bafeb03ada435f4c365e0c269
SHA1 7ced04d85ab825c09d002f82b3b26f828af1ac8b
SHA512 c5bfc57d93b0ce90e0d57bd3e536654abe7803d5584f6793b9acc31cd5972d8264b4aef7ee8f452560999a547ec37ceecb070254815a07ef5e89bb5d12c82480
TLSH
T15AF0E237E9898C930BF8A25A2435A484F20E133FA901FD077070C0CC1F392106698259
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\Chrome\fingerprint.json
Size 220B
SHA256 2e9723a2e4b0ee703578fa6d9e4ef146f97b2510231ddf5603cb653d98e517f7
MD5 fd5308b01d9f6028c333ae3019c07453
SHA1 0f41e39d2716816dbca3b2d24568b8303b766fe9
SHA512 7e1fee7bcdfd93b467ecf0cd6d65c11f04a2636b3fd41b4b6a6f573dd2fed3673c2de8cc9d783527a39e9ef1ea93f6e3922d9d1ad5874037bde14e362c682454
TLSH
T141D0A906A808806A2DB98090ED19046BB2A10F0B27B02C03B2BBA41804103275024B7A
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\Edge\fingerprint.json
Size 218B
SHA256 d464d807bd2c76a287ccac83013ad8c2687ab1c0c91f90750394c765e2b9f3b1
MD5 2f8d705020e57df8b37f4b2076ee50b7
SHA1 1ccc91ff5c54090809618d6706cd9a41ff205598
SHA512 c761701a0855f78a31d49fd4104001d6af3c82f3d85c3be9d34b923d9843b1e55972dd26afa464843ed559e3167031b8f33000620cf991cd729affb6ac1ed7e9
TLSH
T16CD0A9069C08406A2DB98090ED2504BBB3A10F0B66F02C03B2BBA41804003271024B7A
MD5 SHA1 SHA512 TLSH

Submit Download

console.log

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\console.log
Size 1KB
SHA256 ffdfbb1c24caec337d0ab8c666f752c599d1db28c656816060d552cc2730d135
MD5 86ffffdf4f100f7fcdbf29de578a0a12
SHA1 877373c7830f5e8f3dc4eb98d1a8aa59edb15dca
SHA512 cf6e540617ced4c84b21adef3d6742a1819ce2b71f77e999cc7af4bea382646b5e32c3a820b2976b2574d353dd5576bf38fbc94e1b75ca11f51e9cec09492bbe
TLSH
T18A4105B15C5A894C3972F0EE6E07F52F9A80B906FA0910B0BB9E3038C7DE4C71584576
MD5 SHA1 SHA512 TLSH

Submit Download

program.log

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\program.log
Size 3KB
SHA256 e951e3314463f84ccfa163fd802eb5064ad782625a7687f8d7b212d937cecf8e
MD5 c2e7e9c5f5d0cf50172799f5a9a711e5
SHA1 968435662186542d5d0ef11c8e8a1608326a57f2
SHA512 8e2c663c1d84dbce463ee971893c3a9eacd885d54d19bcad9b7f92badaab42d0281524deefc71ea6ad3622910d5e681fc1158ec99ac4c7b2e3830bf565e60c73
TLSH
T1CB71F7D230EF4499E98BD59BA13A480EC4833012A58F7D62FB3448889BDBC55DD6EB71
MD5 SHA1 SHA512 TLSH

Submit Download

system_processes.json

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\system_processes.json
Size 4KB
SHA256 b18084c98c9a0d0066c8e62053b809f98565336a0c6181d9610adc6204189613
MD5 05da8160b48395d81125614b7cb965f0
SHA1 d0ea52cf3ff7befd1aeefdf5888f0511d6fa0b5c
SHA512 d8636debdff50c4594f1845047e55ca1d246995b89f7cc1577fc777e7efa43ad25e0d72bb91b54a2400b0d7e03cf8c4ce1d6fbeeff810bcbb885e6e81bc57d69
SSDEEP 48:PzJ/0/X///9/Pm/U/Yb/Gm/b/+/6/2/+eB/S/nJm/6/E/HkT/nA/nf/I/0/o/S/P:CjMe21sbx9xv8AtnK1LkoWboNf3OX33
TLSH
T19CA128A7D8A64D0D18B892F528B80753F186533FC2295F9F31B5081C7FB2925E06BDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_software.json

Path C:\Users\Admin\AppData\Local\Temp\grab_240676078\system_software.json
Size 7KB
SHA256 1caf8f8d79662395748bb50a8fbf18bdb36cfb9c64f0a40ae59a90befb388a7a
MD5 bd5e004a68a28c8f6ef79d485138250c
SHA1 c02677500899653aafc2c802d09074ae233f9de1
SHA512 b0b79992ac03b760e3bd12aee28218c0d2dd6b19e5c6a686d0537fc46d9f03636a94f8fa1ea2d78734de686109c6b09745f587f76e3ebe1dbdede3e39394d3a2
SSDEEP 96:xXDGM5DXDD5/D6dDhWADDOpDw6Dd/D6vyDZ08ckD8ZpMDmD3Dm6DoQDdhDdDGvDN:Eg68cqi2uUhWX+Fr8ZC+w
TLSH
T1DAF10877DA55DCB75A78A7A1702245A2F2B947DF22085F0A30F8120C0F776B6A37495C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upd6BF4.exe

Path C:\Users\Admin\AppData\Local\Temp\upd6BF4.exe
Size 2.7MB
SHA256 5571506220640fd0ec9522ef28b17659bb96a7e74be9fb3f99a34fdc2c115cc1
MD5 7fe7bd855a8f401789b98444d6175b3f
SHA1 12ccac56c3dc4c824d500fc5a9b7700bff6b22df
SHA512 fb8830b4b22e611cd15f9a4fac037b112c02a43e5bc1b262fae8a5c29d6d8051f88f55744ef950c3097b1483c3c144ca4e56bcf1eab38bd0e1f7cdf9dd9d5c42
SSDEEP 49152:4+o2YwC1he2TC9ilF+JvDhpG22b2/h3mZc0FJiFV9a8GObWBsI6Jja3IJCUCNDMl:41bTdUDhpG21/hWZPzh6Jja3IJCUCFNo
TLSH
T1C4D58E57A7B900ECD167C1B8CA068617EBB2B4451330ABDF1790DE662F23AE15A7F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3820-56-0x000001C48C0F0000-0x000001C48C2E5000-memory.dmp

Download

memory/3820-4-0x00007FFF0FD90000-0x00007FFF0FF85000-memory.dmp

Download

memory/4188-69-0x0000019068210000-0x0000019068232000-memory.dmp

Download

memory/4188-70-0x00000190685F0000-0x0000019068602000-memory.dmp

Download

memory/4188-71-0x000001904F460000-0x000001904F46A000-memory.dmp

Download