1be0e16918116150ee776335a9e743729e8b4e33a7229d7a7b1f1051a1c7d2b3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe
Size 277KB
Sample260824-lfrx3a1tes
SHA256 1be0e16918116150ee776335a9e743729e8b4e33a7229d7a7b1f1051a1c7d2b3
MD5 6cd753f96863802b9777cca789d4d949
SHA1 56ad3613e7ee3466bc20d48cf3b41326d1eb1f95
SHA512 1a4df5d5cbc2c3cd7780ee3b8978a5f8d846d106596c97d76f822fdddc797d8fd7c846e2038dcfa1d624e46c1583908d851d158a67b12a49fad502af89d7d038
SSDEEP 3072:Z0ZMcEwOl8pG4ymgos57NqIHeYBZgivJYEF62G9C5jTla5I1JpayRsJM41l+lZwt:Z0Zuqs4Fg7Nq0eYIwYS1pa7XVc99
TLSH
T1EE546C59B7A00CF9E9A7C17DCD424906EB72BC4747A1E74F03A04A961F276A09E3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe:id.dat	2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe:state.json	2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe:state.json	2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe"
1⤵
- NTFS ADS
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe:state.json

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_6cd753f96863802b9777cca789d4d949_cobalt-strike_icedid_stealc.exe:state.json
Size 40B
SHA256 7294e9204d0c1cb9bff7584e4df38f46555d8981a311869a311f4151cdccde3e
MD5 4df3774d42d3e99ff02b10b7fe846a93
SHA1 42ec73d8efc3535b3106b7f9a78d65057c376c63
SHA512 cfaaa45d25a32f9fa83cccf111a7b964d897de0635c2c3360e67cce0f5a10732fba50647366fa65baa9bd79d5e811ed20dd91f0de51a95bc565f281fd2202ea2
MD5 SHA1 SHA512

Submit Download