9449dbefae73e3d51b466b70df7752e55d6a20e725ba631662a56421e8f597a5

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5ca179beb0a420fe22dec59bcc8969ed_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 383KB
Sample260910-ty8mjaej2w
SHA256 9449dbefae73e3d51b466b70df7752e55d6a20e725ba631662a56421e8f597a5
MD5 5ca179beb0a420fe22dec59bcc8969ed
SHA1 ed3165bbc0caa7c1c7d151e8e8c8eea2153cb329
SHA512 f403a290d3d5184bc727823b69e0469d9878911646897a31b94ec9ab1b98e47306b725d4b0401b9ba7409748b3f2e07f08186dee00103800154167f7cfedd2d8
SSDEEP 6144:CSmtb3rvuBipefZkvS7JEFi1YkwEeZFjvmAs2S3tsGo:CSGb7vuhfSvj2YlEs+As2Qo
TLSH
T138847D5677A804FCE4B79239C8564A06E772BC164760EBCF03A047769F236E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3328	WindowsAntiMalwareServiceOpt.exe
4144	WindowsAntiMalwareServiceOpt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3328	3480	2026-09-10_5ca179beb0a420fe22dec59bcc8969ed_cobalt-strike_icedid_satacom_stealc_vidar.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5ca179beb0a420fe22dec59bcc8969ed_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5ca179beb0a420fe22dec59bcc8969ed_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\FeatureX\WindowsServiceOptimizer\WindowsAntiMalwareServiceOpt.exe
  "C:\Users\Admin\AppData\Local\FeatureX\WindowsServiceOptimizer\WindowsAntiMalwareServiceOpt.exe"
  2⤵
  - Executes dropped EXE
  PID:3328

C:\Users\Admin\AppData\Local\FeatureX\WindowsServiceOptimizer\WindowsAntiMalwareServiceOpt.exe
C:\Users\Admin\AppData\Local\FeatureX\WindowsServiceOptimizer\WindowsAntiMalwareServiceOpt.exe
1⤵
- Executes dropped EXE
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsAntiMalwareServiceOpt.exe

Path C:\Users\Admin\AppData\Local\FeatureX\WindowsServiceOptimizer\WindowsAntiMalwareServiceOpt.exe
Size 164KB
SHA256 5c036996236f12546ba2c2952d5fbccaad1607e46e3ffddb80616afdfd97f0f8
MD5 f0b521f3f69da31a3fbce04c04f02041
SHA1 d5cc7ce8175cd8f9068d5ffd08691bbb74e7566a
SHA512 c8774e2162fc8e4981c7d20f9403cbd30354963dd7c8cf2e2000541ca0b549071568a1bb0f3c60d7908ead091a73fb22f6abe02305236925ce437fddaf597bce
SSDEEP 3072:2d4UgMYkUDwLeZje/MTlj1pmAktDQbkievbz3iEME4G4RH5:21YkwEeZFjvmAs2S3tsGo
TLSH
T176F35C1677A810FCE0B79238C8561A06F777B82607A19BDF07A046765F236E1DD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download