27854f053fd3a59bba31edb8dacdb7b704a48b47807f715ac10d9024e4f94863

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Size 215KB
Sample260819-k1mcmsgp8t
SHA256 27854f053fd3a59bba31edb8dacdb7b704a48b47807f715ac10d9024e4f94863
MD5 b9a6220117c074198b5870c00619c7df
SHA1 bcdae2386dac8b07cfb868b4f1de637d061b2f05
SHA512 4ca6bf0fefb65ef7853049f802cb63e19fb1446d358e4357bccddac54386f85d5158f15e15950cafa8b8623c090d972ffd39a387af479cafc32936e9c73f2e07
SSDEEP 3072:uFgauwqgLQLpef15MENY60jlMotZasYI9AecCKAGnC5Qp+qCqvSBkRbvoNn:sdTcDft9iAMu3UQ
TLSH
T1F1241A0BBAA518F2D5BBC039C582650AFD7278A24770EBCB57904A674F23BE49D3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe = "0"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe

Windows security modification 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe = "0"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9a6220117c074198b5870c00619c7df_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Windows security bypass
- Windows security modification
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads