Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 14:56
General
- Target 2026-10-22_4453f5f05665a22bc2edd50a0fad3192_cobalt-strike_icedid_ryuk_satacom.exe
- Size 1.1MB
- Sample261024-sa6btsvwat
- SHA256 2de08e8408154280c93450c0d116643baac0dcaf74181ff81d86a4efdab9c0ed
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_4453f5f05665a22bc2edd50a0fad3192_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4453f5f05665a22bc2edd50a0fad3192_cobalt-strike_icedid_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3320-4-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-6-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-7-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-5-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-3-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-1-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-0-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-8-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-2-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-9-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-11-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/3320-10-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-12-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-13-0x00007FFBE0F32000-0x00007FFBE0F33000-memory.dmp
memory/3320-15-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-18-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-21-0x0000000008ED0000-0x0000000008F6F000-memory.dmp
memory/3320-20-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-19-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-17-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-16-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-14-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-22-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-23-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-24-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-26-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-31-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-30-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-36-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-38-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-37-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-35-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-34-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-33-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-32-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-29-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-28-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-27-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-25-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-39-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-40-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/3320-41-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-42-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-44-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-45-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-43-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-46-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-51-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-50-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-49-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-48-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-47-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-53-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-52-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-54-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-55-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-57-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-56-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-61-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-63-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-62-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-60-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-59-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-58-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-65-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-64-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-66-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-67-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-69-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-68-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-71-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-70-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-72-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-78-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-77-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-76-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-75-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-74-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-73-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-79-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-80-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-81-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-82-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-83-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-89-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-90-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-94-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-93-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-92-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-91-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-88-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-87-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-86-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-85-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-84-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-95-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-96-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-97-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-98-0x00007FFBE0E90000-0x00007FFBE0F97000-memory.dmp
memory/3320-99-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-100-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-101-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-102-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-103-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-104-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-105-0x0000000001390000-0x00000000013A0000-memory.dmp
memory/3320-106-0x0000000001390000-0x00000000013A0000-memory.dmp