Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 19:55
General
- Target 2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe
- Size 203KB
- Sample261014-ynhetaav7t
- SHA256 3d859c9613cf4a6c8402a6a7d4b3271fc844d68ed4b7dcbda96ff1004cb14dc6
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom Pwn3rzs' Edtition v6.0.1
Botnet
-
Default
C2
-
89.106.83.193:4449
Mutex
-
xorkyupaparc
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2988-0-0x000001E988D70000-0x000001E988D88000-memory.dmp
memory/2988-2-0x000001E9A1980000-0x000001E9A1990000-memory.dmp
memory/2988-3-0x000001E988EA0000-0x000001E988EB6000-memory.dmp
memory/2988-5-0x00007FF818E1F000-0x00007FF818E20000-memory.dmp
memory/2988-6-0x000001E9A1980000-0x000001E9A1990000-memory.dmp
memory/2988-7-0x000001E9A1980000-0x000001E9A1990000-memory.dmp
memory/2988-8-0x000001E9A1980000-0x000001E9A1990000-memory.dmp