Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe
- Size 131KB
- Sample260810-t3pp8ahd36
- SHA256 890219d60289644866410eb0ef15e78d101faf6c6efa084b7baf7add71b6ffc2
- MD5 123fe805dbf17c8bbc47db00fdf01458
- SHA1 19c1bb343c2ca3e95ecd698592a27ab2ae3d95b6
- SHA512 9a04e227c6d6f5f342e0668914a45a5c66ec67369d59a4088171dbaad3e7d56117446637aae3dfea3487c5d78ed23f78379d7334df0ac243f7914df2c3fda72a
- SSDEEP 3072:MkcVnZwZA2Jte/k4itmVPGhtPeqFB8heDkk:Xc5GneimVu/j6it
- TLSH T172D3595773A430FCE1B7C2B9C5920A56E772B8364721ABEF03A446561F271D09D3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe" 2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe" 2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe"1⤵
- Adds Run key to start application
PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_123fe805dbf17c8bbc47db00fdf01458_cobalt-strike_icedid_satacom_stealc.exe1⤵
- Adds Run key to start application
PID:860