Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 22:32

General

  • Target
    2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc.exe
  • Size 483KB
  • Sample261011-2fw5saac39
  • SHA256 6b2f31d3ea680cc237fd5a34f09abe7bc0d9cf2b25a0e7d30cf6d1280b152c0e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    PID:8
  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    PID:5072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 508B
        • SHA256 dbe72b55eff6234eba1f2baa03dffbbe2a6d9e91958e8a637d8a9b42bdcddd97
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 4KB
        • SHA256 5565ee772c14b34f8ed273811c6adb2c85834959f27150494ebededa8c044ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 4KB
        • SHA256 41bf7e934aed64e8301c4cf85c6c2163229d9db013f7233ca8f4b9030cb69b76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 4KB
        • SHA256 d539516cb502317bce149141009c1565f46822abb44e3d77626e43388632d7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 508089fb2ef52d28befec7c0058821de705a3db25965b7d71bb0975e8f959103
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 a7c719bcc98fdef3e8c468464c333bf121eaed58200c9b192194765c184de1d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 f8b8175e8e7a6710e2d44b11b8c51c5b3921aa2d1edcf3a1380abd4b85c7fa16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 092a673c40f8ee87c2b4bfc2e16ae166cfb1f8dd4caf7282c85a2e6216e9d442
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 688B
        • SHA256 4558c3f4f341a39eb97d8c638ec6b114e88a07e4d6fe34f106d57063905e232d
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 98b91628ce5821fe0266ef52b1a491ad15243f8a3d48abbfb39e7fa2f62b02cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 a1f8924654e538a9331f6f91a00eeb7f38b2c329d637dcd5e99cd319c970c53e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 5KB
        • SHA256 38a4959ba6b00db3219e86965898374d6d407d96a324e46121941c71712e6dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 4edb066d15b2da90225f23d5b5d5edc05d579a3ef8afe315c0aca35ecd810276
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 cfa28a8a69404b4825089bc06120ef4e11b1f84705b77a6304c7cd492761180c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 7ad29fefe8595111ee7c37f8f2d5f47fa5312dafb194bd5219449ba82b5943b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 71447ea158e9c2ab9f4ef59ac38591dd26906b0705df79eafaea209d3655f9a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 f87cee8949fe2dabd5c6316d1ebb517588d7c18e603a177db00a034ef1bc1f02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 6KB
        • SHA256 1ce7ca8791081f2ac45742e9ad2b7a1f7d58e29625c343ab2f0b28e92cdfd092
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 85c396cf5f40cae7e26286cbd4fa43c25f20c204f943d4d039682e037ee00c63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 868B
        • SHA256 f0b4a304e372434f5a337a0af7da9dc5257e40618157ba81aa18ec726783e9db
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 d166a90f6ccdca372b8c7fed7f78fa70f9db61cd559ef9981691bf6f192945a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 0086f9d1fdb52160682ebbf47f245d273553a0e9a467f7a899f9a16db29492c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 9c85dddac1e74c83d085f23fc2c3bdfecc7cffd26fceb339f0f3dd4ce3e517f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 07927da39843aa2d1b377076767de86c9aba0016a33adb028d5ef6205978995a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 7KB
        • SHA256 d676b578f40f018d524c27823d9cdbb7ae3d24c4f0e76ed7d051a26042b087c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 8KB
        • SHA256 6bf7031c91841b46f1dadd9fe6789bdd7b5fc3c06b67759e6ac247bb4eea15c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 8KB
        • SHA256 2836ce4e31dd819e21c6399508440456671a73f11b63c234f65a6914e8a119b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 8KB
        • SHA256 9b83fccdc31efdd5fabcc142b5636ebf7a058b2c28a132126503d87ee4f35336
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 8KB
        • SHA256 d01e97d1232d697cd3c5ba0e3101eb51ae9bd586062f97ae81b22a040f142e06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 8KB
        • SHA256 c247c06a796eb759b471aa4981440b12f034e4919d0ae678db6e65bd69ab3552
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 4aa2fdf1849248fcf81107cf3c6661a308dd28c63f37b1dcfd404240b57340ef
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 59e8f2bb03a6a7fdc3f4bb1da81c5d4999bb252accc781bd52b15e98639ce1a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 6702963fbe94342e9aa23e10850b6ac553768d38816869cb3886454347f08f50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 96bb8fbf6b10deb2abbbd7cfd69d4bc8a3641e857d26d7675f00206bdc067a27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 48db47279388352e0086b074ff5e5d43ad4b75485f17fc1b1d72339670addd04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 bd172642add06a6d027ef17630783be07114dfc279694cedb5560dca231962e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 9KB
        • SHA256 6a61ecd49b44dd9530b1323ff3a620aaa66e4416404312e924534a112b68c065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 10KB
        • SHA256 ba044a2221439dcff3060495f186cfef6e5dc6e21b048be6d08841f2727a9704
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 10KB
        • SHA256 4db70d1bfa6fcf9749c7ac2007e46b7bd3f5bbdc7ada3eb88328018d81e45b12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 10KB
        • SHA256 571831d28978f406ac74acb30cb0f4d66b9ced8c8c5a9d2d80025d5de71826a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 10KB
        • SHA256 0d316c18ad0d8770502afddaa639abccd651e72edda76f5beb32bf4836749abe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 3cdbb4263f90a265b05a4c18d8ad19e685968e8552983534571ee712ec0dd8a0
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 653aba0f6cdcbda5f84323ea99961ffaadd6d220d75c72648b009ca9e79ad672
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 182B
        • SHA256 fbe2e119356dc790a725931d97499c1381e5dc991c5fed8d451ab3d77e8c3851
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 6b5187df95f0a5ed6ba54f7e06152ca56f0f13d371a5a1255143e08327fa1932
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 c23d6505701c53e3cc6c61fb65dcb7c1aa9b1db9383e2b524f237cc69ad02f05
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 1KB
        • SHA256 fd1fd64a8b15c9b6bfbb19930a036fb39e7d17f7bb2d91b93e59cc5d76e331d6
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 f5f902d10277bd21101ecd57297fc8aa852b57ed54ad467ac948ace9c151e693
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 42ef019d930cdd71112463592049e3848047f956024b512a7dc9d447ae98d293
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 702fb4b3a651ac82885ab8ed44002befd1683fc4192a75df8e17adfd0f95d5fb
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 15c00700df532308c7bf25f77dcc7d7500f696a1943e924e1b93c45cbcca22cf
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 9367e1bbda2964375cc2e18e87bf236beb8ea1bca86eae05cce3cae9d9326ece
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 2KB
        • SHA256 cf6e48ea265afd19b1ef8c6c8e07a68d53476e54823d329938819731e9d7a3b5
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 63568b117be9fd72faedb6223fa6aa06f1d00ba77797e4decc17cbffa7ed8ed2
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 397B
        • SHA256 4d8c9863be42641652875dc49f5e8e47ea5a9d2a89323b4e47c03b180ccf3064
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 a9e6a87fc629dd86b890e556c45b024fe6d81775e718d6db0602469a82bc36ce
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 ba6083103e8ec079cd3ce3736f0cc212baf508ef8a8688c603caa1381916235e
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 d8fbe4445cf2b36b07b041c7c48145f2c7ae035c3e1af27a62ffdcea133c5bff
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 cb580e0fd830958ea0e2ac8dc3332fe34611ae1d51f1b7dfef80cca66103837d
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 3KB
        • SHA256 c9b0befe33d9648b9c8d7c973f5c45b6d274e3c63d60912a2022b34eaf991688
        • MD5 SHA1 SHA512 TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 4KB
        • SHA256 bdd19d803240ff056fe7b74041ebfc445ae7ddcb8d54150af6de0b71fa99105a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        client.log

        • Path C:\Users\Admin\AppData\Local\Temp\client.log
        • Size 4KB
        • SHA256 a85c33303b5a347ce4a0fcd7e34744232935eb9213cae5cd64d622fc30ebc2b1
        • MD5 SHA1 SHA512 SSDEEP TLSH