Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 21:33
General
- Target 2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom.exe
- Size 1.2MB
- Sample261024-1ec5vaes9m
- SHA256 22249fabdf1cb0c3a41a86f16d93c475e2c21e6df0b7c44c8acba6b416d4d065
Malware Config
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_106663a507e1b7b4586fea07fc5daf60_cobalt-strike_icedid_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1700-6-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-7-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-5-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-4-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-3-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-2-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-1-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-0-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-16-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-34-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-35-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-37-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-36-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-27-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-25-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-23-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-32-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-13-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-38-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-33-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-31-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-29-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-28-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-26-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-24-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-21-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-20-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-19-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-18-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-12-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-11-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-10-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-9-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-8-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-17-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-14-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-15-0x0000000003420000-0x00000000034C2000-memory.dmp
memory/1700-39-0x0000000003420000-0x00000000034C2000-memory.dmp