bfb375435dd4317fec90151e8603f642ddedf8458bde7a4baec46c32c79c4948

General

Target
2026-09-04_64934e0c6fc80a0d8c07e462cd0f51eb_cobalt-strike_icedid_satacom_vidar.exe
Size 233KB
Sample260905-krtelaxyfy
SHA256 bfb375435dd4317fec90151e8603f642ddedf8458bde7a4baec46c32c79c4948
MD5 64934e0c6fc80a0d8c07e462cd0f51eb
SHA1 b5de7cab203983fe1e32c2aa54721609d888ee49
SHA512 5dbc3922abe76e10f91ae6d4da510007773ba3f51a959306c04f619238a2d4ed73b5f4814d37fc170e468b689f30e841ad8318922783c54abe07a0b7a845933d
SSDEEP 3072:eaYsU59squpcirqWt9VjZpR+KjgUFSU9B3P9mDuXzoY4635fhgJs:Q5bWcirq6zj/kKjgmNohUO
TLSH
T165347C0937A55DF9E873E17CC9426E05E7B2BC120362DABF43A142574F23690AD3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1048	Wininet.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs regedit.exe 1 IoCs

pid	Process
3496	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
716	schtasks.exe
3416	schtasks.exe
1672	schtasks.exe
5736	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3496	regedit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 716	4708	2026-09-04_64934e0c6fc80a0d8c07e462cd0f51eb_cobalt-strike_icedid_satacom_vidar.exe	90
PID 4708 wrote to memory of 3416	4708	2026-09-04_64934e0c6fc80a0d8c07e462cd0f51eb_cobalt-strike_icedid_satacom_vidar.exe	92
PID 1048 wrote to memory of 1672	1048	Wininet.exe	98
PID 1048 wrote to memory of 5736	1048	Wininet.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_64934e0c6fc80a0d8c07e462cd0f51eb_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_64934e0c6fc80a0d8c07e462cd0f51eb_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\PLA\System\TaskGuard" /tr "C:\ProgramData\Microsoft\Wininet\Wininet.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:716
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\PLA\System\SystemUpdateNewBackupA" /tr "C:\Windows\SysWOW64\regedit.exe /s C:\ProgramData\Microsoft\Wininet\Wininet.sdb" /sc minute /mo 1 /ru Administrator /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3416

C:\ProgramData\Microsoft\Wininet\Wininet.exe
C:\ProgramData\Microsoft\Wininet\Wininet.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\PLA\System\TaskGuard" /tr "C:\ProgramData\Microsoft\Wininet\Wininet.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1672
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "\Microsoft\Windows\PLA\System\SystemUpdateNewBackupA" /tr "C:\Windows\SysWOW64\regedit.exe /s C:\ProgramData\Microsoft\Wininet\Wininet.sdb" /sc minute /mo 1 /ru Administrator /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5736

C:\Windows\SysWOW64\regedit.exe
C:\Windows\SysWOW64\regedit.exe
1⤵
- System Location Discovery: System Language Discovery
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wininet.exe

Path C:\ProgramData\Microsoft\Wininet\Wininet.exe
Size 233KB
SHA256 bfb375435dd4317fec90151e8603f642ddedf8458bde7a4baec46c32c79c4948
MD5 64934e0c6fc80a0d8c07e462cd0f51eb
SHA1 b5de7cab203983fe1e32c2aa54721609d888ee49
SHA512 5dbc3922abe76e10f91ae6d4da510007773ba3f51a959306c04f619238a2d4ed73b5f4814d37fc170e468b689f30e841ad8318922783c54abe07a0b7a845933d
SSDEEP 3072:eaYsU59squpcirqWt9VjZpR+KjgUFSU9B3P9mDuXzoY4635fhgJs:Q5bWcirq6zj/kKjgmNohUO
TLSH
T165347C0937A55DF9E873E17CC9426E05E7B2BC120362DABF43A142574F23690AD3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wininet.sdb

Path C:\ProgramData\Microsoft\Wininet\Wininet.sdb
Size 172B
SHA256 fa4e3501c6032d5a1e403c973cc0504a5057221847b2ad683f8476f02e8bfe12
MD5 b5dd22c794086a658b3b3a839bba5877
SHA1 ef673d87bb2ef6c491b3d7b5bde9eb0add2d1bf9
SHA512 0b6968b6074e9b20acc86a61f84ce0b0a74784e9eb40a68cb3cf980056fca19f8f7b4c06ae1a2e6ceef2668aca7c449c9cd33d88c9ed0b50fa132061a22cd02b
TLSH
T1B2C080C52415512755F07F10990D43113FF163DF3896C5D8589D51903D856C783251F6
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 0b4a94647624b1943db076a94c669663509d752759f7806a318269a7ab0b7301
MD5 d26131acbf6ef71dc752e9fc257a99cd
SHA1 8790cc378cfb33092fc284fd64fc4b5991e68619
SHA512 1876b5a1ee25dbfd0a7b44681429c543f55d0416c24c2e99b176f5d8dbe9cec8ec0a9953571e2a706266ee09e8ac5c3454c0431456b93e00c8204742f9fe9080
TLSH
T19821EB6A45B51A50FF805F0322C5C4375DF57BC588EC0049923AE99725003D83F2795D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 a696dfcbba70d9255cc9c717c2411a74ccc0d3d75a3939bd775a29f554a30ad7
MD5 f62be34300c82006d1a67c78d8ed5d38
SHA1 b38a7a43b0743bb4b3c973d2e7fc6c127f2f67cd
SHA512 f88be892f97ee69693c4692a68470b818ffd60c63086717e13131a91ac54c7b51f721d63c1d8b8db610edcd0a13e0ff8bc9ba0d1b156ea96662175091838628b
TLSH
T1B921D84B86752493F313CD4B0588FE736CF5B6E260DC1519F01BC2AA25253F26E49669
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6
Size 1KB
SHA256 da2349bdc4ba856761e96925a473982338024dfa1a6c0d986a76cbac9acd4fb9
MD5 bbf3aefdb2fe35ea9ea6dea7fc4826b1
SHA1 8133e9a43b66dbb7f6a98cf6d699d778edeab55a
SHA512 34760c94afa8680e9a663c843172d17e6cb3d626d700dc87720bd6043a804bd5332967a3830834398d0a54be60c285892bf36b02a37ac48511f8501aff853169
TLSH
T13621B9D7595468822740AC9A0CD7CFF33C64E4DF5698B5501136D05DAC2C3932F0C9DD
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 fe3020e019d4c3566ee7854ad45b4e7de2365279f9b5cbe1c03fa0549c5ed18e
MD5 a560acf87b7d418b065d19718b648cb5
SHA1 493a3bd2f69a0d8a92649fd375e79254dd1c18f8
SHA512 f71343f856eb82b451a41b5b361af8da1caed8d5e96583d4da9e7afe73555ea096a454dd83883ecb9dee989c99e19092715d51f30bbe779431ffe37aa4352ec0
TLSH
T18FF0DC188DBD123FF030CF3546D828628A77FA12300402A022E4870CBA82E096C5123D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 361adefc0a69f712dc9cccea7e0769393ccc7486e67860d38c98db7d7c497ae8
MD5 af282e640cf1a742a1ffd8c519789db5
SHA1 d31224d1a940ba25e4b6e9b72c222dae2882e4a6
SHA512 e0050a454f8d5d4202ff966b51b2b3594e6c542e084079c6834c39c984a3c5cf703523267b665ef582891413a97bd3d23f54a2738c5a5f33ffb8c07b76dcfac1
TLSH
T141F0553816E59069F232CABD21D727F19B7BF91328041BFE0A99464C6F19F102CD667A
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6
Size 536B
SHA256 c61a9963c4e922af8cfb1286639250aa1b6818a3aed695d1f020b9733db58581
MD5 680f1b4865005f1fc30bfb76457b5e09
SHA1 c0038ed97512e137b352e5a6a72156eff563cc67
SHA512 f3d0b5eb2078f455050f280cb9fadaf7b905124fcb3d7bbf8bd6a17127466689837a99e42545d71394a4733e10ac0cab13aca554c5a27f57f112c52267cbd410
TLSH
T195F09E1895FDC00DF077D9741BC6A2659C22F505F80646AB1D9587186E54F409CE1B67
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads