Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 19:55
General
- Target 2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe
- Size 203KB
- Sample261014-ynhetaav7t
- SHA256 3d859c9613cf4a6c8402a6a7d4b3271fc844d68ed4b7dcbda96ff1004cb14dc6
Malware Config
Extracted
-
asyncrat
-
Venom Pwn3rzs' Edtition v6.0.1
-
Default
-
89.106.83.193:4449
-
xorkyupaparc
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_69ad8014ee5ee97998327f888005cfac_cobalt-strike_icedid_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1320-0-0x000001D387630000-0x000001D387648000-memory.dmp
memory/1320-2-0x00007FFDBF02F000-0x00007FFDBF030000-memory.dmp
memory/1320-3-0x000001D3890F0000-0x000001D389106000-memory.dmp
memory/1320-5-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-6-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-7-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-8-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-9-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-10-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-11-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-12-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1320-13-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp