Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 20:42
General
- Target 2026-10-01_0784a12206ed4df90ec2b51c9f9f0202_cobalt-strike_hijackloader_icedid_satacom.exe
- Size 421KB
- Sample261002-zhb7aavxes
- SHA256 22568de6df52d1ad5b6014a5b98aa3b2e928f46aaf102ca35ca7124e053a61b7
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_0784a12206ed4df90ec2b51c9f9f0202_cobalt-strike_hijackloader_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_0784a12206ed4df90ec2b51c9f9f0202_cobalt-strike_hijackloader_icedid_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_0784a12206ed4df90ec2b51c9f9f0202_cobalt-strike_hijackloader_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_0784a12206ed4df90ec2b51c9f9f0202_cobalt-strike_hijackloader_icedid_satacom.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-13-0x000001833C5B0000-0x000001833C5B1000-memory.dmp
memory/5800-8-0x0000019E5D8D0000-0x0000019E5D906000-memory.dmp
memory/5800-7-0x0000019E5D8D0000-0x0000019E5D906000-memory.dmp
memory/5800-11-0x0000019E5D8D0000-0x0000019E5D906000-memory.dmp
memory/5800-14-0x00007FF7D30D0000-0x00007FF7D313D000-memory.dmp
memory/5800-9-0x00007FFFAE660000-0x00007FFFAE8C3000-memory.dmp
memory/5932-0-0x000001E265810000-0x000001E265846000-memory.dmp
memory/5932-2-0x000001E265810000-0x000001E265846000-memory.dmp
memory/5932-1-0x000001E265810000-0x000001E265846000-memory.dmp
memory/5932-3-0x00007FFFAE660000-0x00007FFFAE8C3000-memory.dmp
memory/5932-4-0x000001E265810000-0x000001E265846000-memory.dmp