Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
15/10/2026, 16:53
General
- Target 2026-10-13_2ee308a7a5d77606f0170c665d40baa7_cobalt-strike_icedid_ryuk_satacom.exe
- Size 1.1MB
- Sample261015-vec7ysdd27
- SHA256 f7dc8e1ebd7b1090e9526d6e267de8d933884cb6d9c9ea0ff8b8171bf9145c96
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_2ee308a7a5d77606f0170c665d40baa7_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_2ee308a7a5d77606f0170c665d40baa7_cobalt-strike_icedid_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3284-6-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-0-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-3-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-7-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-5-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-4-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-2-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-1-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-8-0x0000000008530000-0x00000000085D0000-memory.dmp
memory/3284-9-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-13-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-14-0x00007FFD1F842000-0x00007FFD1F843000-memory.dmp
memory/3284-12-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-10-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-11-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3284-16-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-19-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-20-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-18-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-17-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-15-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-21-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-23-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-29-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-28-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-27-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-26-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-25-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-24-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-22-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-30-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-32-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-33-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-34-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-31-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-35-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-36-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-37-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-38-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-39-0x0000000000B50000-0x0000000000B60000-memory.dmp
memory/3284-40-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-42-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-41-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-43-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-47-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-46-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-45-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-44-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-49-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-51-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-50-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-48-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-57-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-56-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-55-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-54-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-53-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-52-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-58-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-62-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-66-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-65-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-64-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-63-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-61-0x00007FFD1F7A0000-0x00007FFD1F8A7000-memory.dmp
memory/3284-60-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/3284-59-0x0000000000B40000-0x0000000000B50000-memory.dmp