5c42b74c979ecef0f464adff0f49d9e58c0784a697afab4c814c724e4e02db9b

General

Target
2026-10-01_3b52fdbfeea68cfbee6428ec5e4e38db_cobalt-strike_icedid_satacom_stealc.exe
Size 4.3MB
Sample261002-txfv5ay13p
SHA256 5c42b74c979ecef0f464adff0f49d9e58c0784a697afab4c814c724e4e02db9b
MD5 3b52fdbfeea68cfbee6428ec5e4e38db
SHA1 0be2f18c2c2df08ea021a1cf5ac1ccf57ea23d28
SHA512 00004a8cc98336fd451d9a43ac2a958db6d865062918b05ae089a5411579f4742316791881e9f822db36610a040367a0f7da5b16ddd1187c0402d273031fb712
SSDEEP 98304:RJlTZOR1qgJi10gNk1LXQfjG1bj9vPBKPYR3o5faXu41MeR+9pYw/TR:hgLqgJi1nNk1cfjGZj9v06ufiOuw/F
TLSH
T18926330976E54CFAEC67867CCD920A86E672BC564771EACF076056970F236E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1296	Client.exe

Loads dropped DLL 5 IoCs

pid	Process
1296	Client.exe
1296	Client.exe
1296	Client.exe
1296	Client.exe
1296	Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\ = "URL:KHIM"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\URL Protocol	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\DefaultIcon	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\KHIM\\Client.exe\",0"	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\shell	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\shell\open\command	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\shell\open	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\KHIM\\Client.exe\" \"%1\""	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\khim	Client.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1296	Client.exe
1296	Client.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 952	868	2026-10-01_3b52fdbfeea68cfbee6428ec5e4e38db_cobalt-strike_icedid_satacom_stealc.exe	88
PID 868 wrote to memory of 1296	868	2026-10-01_3b52fdbfeea68cfbee6428ec5e4e38db_cobalt-strike_icedid_satacom_stealc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-01_3b52fdbfeea68cfbee6428ec5e4e38db_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3b52fdbfeea68cfbee6428ec5e4e38db_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" -xzf "C:\Users\Admin\AppData\Local\Temp\khim-setup.tar.gz" -C "C:\Users\Admin\AppData\Local\KHIM"
  2⤵
  PID:952
- C:\Users\Admin\AppData\Local\KHIM\Client.exe
  "C:\Users\Admin\AppData\Local\KHIM\Client.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Local\KHIM\Client.exe
Size 6.0MB
SHA256 baf78d8df9602cc16d7de2569a3be4158f2e9ff36bc945bfd5cfef4e6d46934b
MD5 ed2a366885b61af86ff1341d99e0b060
SHA1 cb345e48b7b92be8d5591e6a09858d73bd6d0573
SHA512 d986ed201961892560c25915e864a7ce2b4cd2c1d7506cdfa48e0e0bc9c620bd9ce045fdc4862e519b5b873ad93e9013962b037871cbc7490e9e841350da9069
SSDEEP 49152:R8pskmfSdem64/kckOFSi4MbKZwINaDD6RFW3Oljtk0r/8p8IMMPkNJZNxN05/6f:QsNkH8oUznkc8+IMGr+JCx8
TLSH
T12F56AE5AA3B940ECE477D079D65BB607E772740807305ADB07E0466A2F33AE05EBB721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\KHIM\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\KHIM\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khim.cfg

Path C:\Users\Admin\AppData\Local\KHIM\khim.cfg
Size 48B
SHA256 645e770cf7864bb433fa55df708df623caea152a39668b722dca506307751c36
MD5 da145b3e40635cedf12335644d3dce91
SHA1 ed7ef908441ac7316d23d21016524d2ba2e4d58f
SHA512 ea21dd72c237459fee5e3b2d5bf8140f45ad174f817929eb8cbc68b84710386516d30e8e05c668b78188795851e45e599512d70496f6564a67b7e0bb0ef9456a
MD5 SHA1 SHA512

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\KHIM\msvcp140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fragment.glsl

Path C:\Users\Admin\AppData\Local\KHIM\shaders\fragment.glsl
Size 7KB
SHA256 1b3b2cbc54b73db4eb387da9e43f8446373c0e5b76d2b40ebcc0a9db4e451b21
MD5 4d77cf046648992089e150fde0c6ef1e
SHA1 ead5a6b0aa02aff9258514a549d541d41f2de47e
SHA512 38bd84e66ae86fd5199b2240de6dc4fb39328890780bfc1791bd6a42084922647b3951cb670ef4908af4f9b9738ad91a22fdcca89a8d260c25a8e6dc2ec5cd7c
SSDEEP 96:uZOOFQY721moTtIpkXfYRmd5m6DnKQXv8lgxJDTn7kRJbjj6wCTFJsHtiH/Pi:klQY7cmohIpGwa3DnwaJPg3bjyTLsHwC
TLSH
T1F8F1954CA36102346CBF126D9B8B644AE31761BB4101D652384F53067FB28BDE3ABBD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vertex.glsl

Path C:\Users\Admin\AppData\Local\KHIM\shaders\vertex.glsl
Size 1KB
SHA256 6bf601229cd91e117f48f20a92ec483e4e50294f2f1c045857638c62c1d6e704
MD5 ab26a416770bab7fddff362bca699c0c
SHA1 55de99d27f192517b984b7be6b7d7eaca3651e6d
SHA512 d0068c6a7f154e600c4ac0908f0be599a73ba8e48f83c4c0b81dbdf3edec4b517ce9ad8b7b46c54892ef29d3f4a7c219276e0d0cb3f8046e902110c3d5ff01b4
TLSH
T1B741CFCA677222743D8E3757DD8A22061B7B90CB9901C613650B90036E6E66ED3A73D7
MD5 SHA1 SHA512 TLSH

Submit Download

khim-setup.tar.gz

Path C:\Users\Admin\AppData\Local\Temp\khim-setup.tar.gz
Size 4.0MB
SHA256 758729dcad75efe19fa293706d64ee72988170c2e5003d556918844206fcd9b4
MD5 a8dac697ffafc46e54213389f388923f
SHA1 37da431450a5d27c31f34cc1ff716d8310a964c2
SHA512 27fe639eea2b09578852cab0b34efaae92658040616978b0158c2e766c7e02f730d01f1679ed4c5bac330b83e5fe66c1755142149c970c46b43be2258ad64634
SSDEEP 98304:bJlTZOR1qgJi10gNk1LXQfjG1bj9vPBKPYR3o5faXu41MeR+9pYw/TA:LgLqgJi1nNk1cfjGZj9v06ufiOuw/E
TLSH
T19016334D5CE6C8DFA84B7B88D4FC1FEA7370A5ACE790251C5E1871E39923D609680B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads