ff62c5b555c8396df55dc500d52e6f1c34e7a1c16a93ceda3458a7b494688349

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_1970db7f6f170bdb731c5247caa63bf8_cobalt-strike_icedid_satacom.exe
Size 454KB
Sample261002-xsmdwsys7q
SHA256 ff62c5b555c8396df55dc500d52e6f1c34e7a1c16a93ceda3458a7b494688349
MD5 1970db7f6f170bdb731c5247caa63bf8
SHA1 5374da0cf0f36a1305e190465d9221e6a71759a4
SHA512 e14f32fec94e273fa0fd77f4d199d1096b07311d2d80fb82b3e5a6c3c542cbff058ca6e127a359acce56e1cea51fe5756d26b01b636509d9a95e0c60d46b96ce
SSDEEP 6144:V0EHlSF+zZ4Zcu4a41fzk8zgob1AeXldImVuqWyxKtxqBLaE9Q04AfnnLt:HSsD9SoWeHIirCQRC04Ajt
TLSH
T142A4025A60E5B8FCD632833888250A69E7B5F8346712CFEF523855972F276C14D39FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001b846-2.dat	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001b846-2.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Executes dropped EXE 1 IoCs

pid	Process
3892	E59AE7C00070007.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	E59AE7C00070007.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	E59AE7C00070007.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	E59AE7C00070007.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	E59AE7C00070007.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3892	E59AE7C00070007.exe
3892	E59AE7C00070007.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3892	4148	2026-10-01_1970db7f6f170bdb731c5247caa63bf8_cobalt-strike_icedid_satacom.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-01_1970db7f6f170bdb731c5247caa63bf8_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_1970db7f6f170bdb731c5247caa63bf8_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\E59AE7C00070007.exe
  "C:\Users\Admin\AppData\Local\Temp\E59AE7C00070007.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E59AE7C00070007.exe

Path C:\Users\Admin\AppData\Local\Temp\E59AE7C00070007.exe
Size 362KB
SHA256 b36f4912d690ba6735d81ed5920d5d2e85cb8b55f565910d51e0ad95ebbdf5a0
MD5 7fba8678671374da8303a5036dadb488
SHA1 507b17f0248d6acfa866870de51f383668430ce7
SHA512 d59622a43d25fb8753726d6ac17d008be8821064f2f10b2a532afe19291ccda0984f215114704c8675db884d6e5c9b25d1ef96c1d1fe577e3f3bda15e56b9080
SSDEEP 6144:oXb9K3braVN9P6xYMJCmyPuCFjtp6ur6yr4WZQaJTiSxCa6DeTXlVHKUUIF50toM:oXBKa6xYgtebpM+elfJinfLKdSO5CS
TLSH
T171848E87F58458F8EC12E13D934EE22AEB7678B00754E9C7177066112F6B8E0ADBDE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download