Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 02:07
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe
- Size 3.6MB
- Sample260924-ckdfssbg83
- SHA256 d9740220c7a6ecc00a8851aaf76bae458b353b7ab3fd8019406eed1d7286097b
- MD5 b70387607e4f6a9be549f85658d1ad5b
- SHA1 6ee83614da9677754d838b7bf7ad485a306a4237
- SHA512 d41a83ba88149e931c99f11539e1787d2efb34a7908d8ea243c29e9fb344345852df46e4316a7842a63dc10894219f20561c213e1d7ced31b2f148d68527839b
- SSDEEP 98304:w7kO9MPaTLbj5MhYv9PTEzb9HJTEs5S6QR/mSbyqb3:G84j5euYbnIs5G/m
- TLSH T15206336BA62926F3C0259134C0A9A60583EDBC3503645BDB77137F2E3F616C39DB9E42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 12 IoCs
resource yara_rule behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 12 IoCs
resource yara_rule behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/5764-32-0x0000000000400000-0x0000000000420000-memory.dmp Nirsoft - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 12 IoCs
resource yara_rule behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 12 IoCs
resource yara_rule behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe - UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral2/files/0x00040000000187c7-20.dat UPX behavioral2/memory/256-22-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/files/0x000500000001b7fb-26.dat UPX behavioral2/memory/5764-27-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/5764-32-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp UPX behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 256 StealthCryptorTest.exe 5764 USBDeview.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wine 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: USBDeview.exe File opened (read-only) \??\F: USBDeview.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum USBDeview.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 USBDeview.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe -
resource yara_rule behavioral2/files/0x00040000000187c7-20.dat upx behavioral2/memory/256-22-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/files/0x000500000001b7fb-26.dat upx behavioral2/memory/5764-27-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/256-30-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/5764-32-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/256-31-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-34-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-36-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-38-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-40-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-42-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-46-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-50-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-52-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-54-0x0000000000840000-0x0000000001495000-memory.dmp upx behavioral2/memory/256-58-0x0000000000840000-0x0000000001495000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StealthCryptorTest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USBDeview.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1808 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe 1808 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe 256 StealthCryptorTest.exe 256 StealthCryptorTest.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5764 USBDeview.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeLoadDriverPrivilege 5764 USBDeview.exe Token: SeUndockPrivilege 5764 USBDeview.exe Token: SeRestorePrivilege 5764 USBDeview.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1808 wrote to memory of 256 1808 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe 89 PID 1808 wrote to memory of 5764 1808 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Roaming\ikchwyhp\StealthCryptorTest.exe"C:\Users\Admin\AppData\Roaming\ikchwyhp\StealthCryptorTest.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:256
-
-
C:\Users\Admin\AppData\Roaming\ikchwyhp\USBDeview.exe"C:\Users\Admin\AppData\Roaming\ikchwyhp\USBDeview.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sc_run.log
- Size 487B
- SHA256 6c6aebbdfa4bdd62742fe12d594ff775af6cb49aa279361c1cc3d2c6e70771be
- MD5 6627c0ffaf96aa4d48e3b1def06859d3
- SHA1 0bc76e153607d3e60e3bb392b09a95555d36b185
- SHA512 1b8d8ac93990d8a1be04beb1af791b5f587eae85233f9902fa3fa8629f719c531bc76212998c5b6bdfbaa15091610f1e7d7948109a788db6067b945ea2b58404
- TLSH T1ACF020204BFAC96D9D3280A30B708A4EA1A18A613FC4BF58C30744ED24C930CF2E1893
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ikchwyhp\StealthCryptorTest.exe
- Size 3.4MB
- SHA256 8621b524293331abf7ef7389062ee623d8c25dee2ea25fd9f4087ed3ef4d32b4
- MD5 3da47776a6407b5214aa780804b6c3f9
- SHA1 8160c41d0f96521626a92d6560b42a92006366ee
- SHA512 6b855f473eef257b1961d79501e6c5de43f6701d365dbb2f231748fb2bdf2247f3b0121262abfd6608205238dad43fc42c0964aeae36932993002eeb25117e6c
- SSDEEP 98304:FLXDi1AkGKQx+6R+eOV1qjo6VPjnjxO7hfFlst5HV:dDmGM6aYRAtfkjHV
- TLSH T136F5337E942CF584D5F66736E32EA9673A448753C880E9A45020F42BA3C51F7ED38A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ikchwyhp\USBDeview.exe
- Size 50KB
- SHA256 b0867ef0de4fe5426711c8bfeb5ff685434e49492fcb5b82958436620ae1ac31
- MD5 e954eca94691b85b404817c788794c19
- SHA1 25469faed8d328945a493849911f791f617ef8f2
- SHA512 1450ae637e811ee7cd296c2a33d0985da7c46fb5b8bdeceac9513989eaeddc45c251f38cc43f9ffde5064db1abaa232b1012a23bcc93a738e8f817dfd832af3b
- SSDEEP 1536:7JKKNfH4SU53Vh/YZTQrbqmNS1z6d3NHYFBn:hY353VxY90qmNWz6NFYH
- TLSH T1B433E111DB948E33C9C61A3028EBCD789A15B8147B799F332B927D5FFC76392AD11124
- MD5 SHA1 SHA512 SSDEEP TLSH