Analysis
- max time kernel
143s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 07:51
General
- Target 2026-10-23_bf06cccf9608b1802d37e93ce6dfbe31_cobalt-strike_icedid_stealc.exe
- Size 216KB
- Sample261023-jp4bca1t2k
- SHA256 ca7768204b88047142ef522f858c75bbf4bea04129406b2df32430fa002bd094
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 8 IoCs
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_bf06cccf9608b1802d37e93ce6dfbe31_cobalt-strike_icedid_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_bf06cccf9608b1802d37e93ce6dfbe31_cobalt-strike_icedid_stealc.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe" --shadow2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe" --shadow2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe" --algorithm pearlhash --pool pool.vanguardcache.com:5555 --wallet dummy --worker w3-NVIDIA_GeForce_RTX_3060_TI --password x --cpu-threads 0 --disable-watchdog --background --log-file NUL --gpu-target-temp 75 --max-gpu-temp 83 --fan 202⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe" --algorithm pearlhash --pool pool.vanguardcache.com:5555 --wallet dummy --worker w3-NVIDIA_GeForce_RTX_3060_TI --password x --cpu-threads 0 --disable-watchdog --background --log-file NUL --gpu-target-temp 75 --max-gpu-temp 83 --fan 202⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe" --algorithm pearlhash --pool pool.vanguardcache.com:5555 --wallet dummy --worker w3-NVIDIA_GeForce_RTX_3060_TI --password x --cpu-threads 0 --disable-watchdog --background --log-file NUL --gpu-target-temp 75 --max-gpu-temp 83 --fan 202⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\WinCacheHost.exe" --shadow2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\BackgroundTaskHost.exe" --algorithm pearlhash --pool pool.vanguardcache.com:5555 --wallet dummy --worker w3-NVIDIA_GeForce_RTX_3060_TI --password x --cpu-threads 0 --disable-watchdog --background --log-file NUL --gpu-target-temp 75 --max-gpu-temp 83 --fan 202⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
89986B561565BD40CD252D2331D4559C
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
89986B561565BD40CD252D2331D4559C
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
BackgroundTaskHost.exe
WinCacheHost.exe
memory/1384-40-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-48-0x0000028C68300000-0x0000028C6830A000-memory.dmp
memory/1384-39-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-49-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-34-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-35-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-36-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-37-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/1384-38-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-53-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-51-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-56-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-55-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-59-0x000002013D460000-0x000002013D46A000-memory.dmp
memory/2516-58-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-52-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2516-54-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-67-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-62-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-63-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-64-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-65-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-66-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2720-69-0x0000024778650000-0x000002477865A000-memory.dmp
memory/2720-68-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-15-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-12-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-13-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-14-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-31-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-16-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-17-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-18-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-19-0x00007FF69CFB0000-0x00007FF69FE35000-memory.dmp
memory/2756-30-0x000001F7827F0000-0x000001F7827FA000-memory.dmp