4de6bfe8c3f7bf8eb209937b22b8834ee6c10f04a03d59d9b5e75988d25cd9de

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom.exe
Size 48.8MB
Sample260910-vz8vcsshqc
SHA256 4de6bfe8c3f7bf8eb209937b22b8834ee6c10f04a03d59d9b5e75988d25cd9de
MD5 46832671ce6ff0b6b921730b5c32632b
SHA1 caeb79e10a2b2cf9b138ae41a40481816346dc6b
SHA512 d49839d89ac5c1c7115b5968af24dbf0b012b5b00c00da193f2c40dacc86fa5c8a076176076f252fd0a266b1879ccdc147d90f7785bf1c38e108df3f5da5ee8d
SSDEEP 786432:SW+YgQAnLxSsOPYrYYxwENxsvNcnv4dJGWm:SWtgQAnLxSbmxBLsvegdJzm
TLSH
T101B7D09B931DF01E5BDBA293B88A47A11D2AD13895D338498DDEE35CA7934FC43E7210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2080	netsh.exe
5040	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
240	AppInsightHost.exe
4740	AppInsightHost.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 240	5168	2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom.exe	89
PID 240 wrote to memory of 4740	240	AppInsightHost.exe	90
PID 4740 wrote to memory of 2080	4740	AppInsightHost.exe	91
PID 4740 wrote to memory of 5040	4740	AppInsightHost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5168
- C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe
  "C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe" -Embedding
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe
    "C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=AppInsightHost.exe program=C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2080
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=AppInsightHost.exe dir=in action=allow program=C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppInsightHost.exe

Path C:\ProgramData\Northwind\AppInsight_sMru\AppInsightHost.exe
Size 48.8MB
SHA256 4de6bfe8c3f7bf8eb209937b22b8834ee6c10f04a03d59d9b5e75988d25cd9de
MD5 46832671ce6ff0b6b921730b5c32632b
SHA1 caeb79e10a2b2cf9b138ae41a40481816346dc6b
SHA512 d49839d89ac5c1c7115b5968af24dbf0b012b5b00c00da193f2c40dacc86fa5c8a076176076f252fd0a266b1879ccdc147d90f7785bf1c38e108df3f5da5ee8d
SSDEEP 786432:SW+YgQAnLxSsOPYrYYxwENxsvNcnv4dJGWm:SWtgQAnLxSbmxBLsvegdJzm
TLSH
T101B7D09B931DF01E5BDBA293B88A47A11D2AD13895D338498DDEE35CA7934FC43E7210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4740-2-0x0000025625400000-0x000002562639B000-memory.dmp

Download

memory/4740-4-0x000002562BE10000-0x00000256308BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads