e9c1a2eb027d8edaa5fcda11ded72ad18a9527aa4c35adb6220d50768ea11759

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_ef7eec5203bcf8922b67ec5021555fdd_cobalt-strike_icedid_stealc.exe
Size 129KB
Sample261027-2g3zqaef36
SHA256 e9c1a2eb027d8edaa5fcda11ded72ad18a9527aa4c35adb6220d50768ea11759
MD5 ef7eec5203bcf8922b67ec5021555fdd
SHA1 f29e8eb8fb848dbfae0a151febdcbfea425fc9de
SHA512 59898de69dada7e762c54f6194b44db9b942a87083720f7aa681f06db32e7c0e3bed1ad0c1e2fff7dc0eec554cfa2d235b32eb43425e390e1d1efa3fa74fefee
SSDEEP 3072:Po6541yLeKcpaFSrIUK9ielxodtP3uIoAe5nXUv/:PovyLeMFSrFKZxQoAQM/
TLSH
T18FD35B5BB3E530F8E177C279C8960A45E776BC760B619BDF079042661F236D08D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4780	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4780	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1360	sv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4780	powershell.exe
4780	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	powershell.exe
Token: SeSecurityPrivilege	4780	powershell.exe
Token: SeTakeOwnershipPrivilege	4780	powershell.exe
Token: SeLoadDriverPrivilege	4780	powershell.exe
Token: SeSystemProfilePrivilege	4780	powershell.exe
Token: SeSystemtimePrivilege	4780	powershell.exe
Token: SeProfSingleProcessPrivilege	4780	powershell.exe
Token: SeIncBasePriorityPrivilege	4780	powershell.exe
Token: SeCreatePagefilePrivilege	4780	powershell.exe
Token: SeBackupPrivilege	4780	powershell.exe
Token: SeRestorePrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeSystemEnvironmentPrivilege	4780	powershell.exe
Token: SeRemoteShutdownPrivilege	4780	powershell.exe
Token: SeUndockPrivilege	4780	powershell.exe
Token: SeManageVolumePrivilege	4780	powershell.exe
Token: 33	4780	powershell.exe
Token: 34	4780	powershell.exe
Token: 35	4780	powershell.exe
Token: 36	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	powershell.exe
Token: SeSecurityPrivilege	4780	powershell.exe
Token: SeTakeOwnershipPrivilege	4780	powershell.exe
Token: SeLoadDriverPrivilege	4780	powershell.exe
Token: SeSystemProfilePrivilege	4780	powershell.exe
Token: SeSystemtimePrivilege	4780	powershell.exe
Token: SeProfSingleProcessPrivilege	4780	powershell.exe
Token: SeIncBasePriorityPrivilege	4780	powershell.exe
Token: SeCreatePagefilePrivilege	4780	powershell.exe
Token: SeBackupPrivilege	4780	powershell.exe
Token: SeRestorePrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeSystemEnvironmentPrivilege	4780	powershell.exe
Token: SeRemoteShutdownPrivilege	4780	powershell.exe
Token: SeUndockPrivilege	4780	powershell.exe
Token: SeManageVolumePrivilege	4780	powershell.exe
Token: 33	4780	powershell.exe
Token: 34	4780	powershell.exe
Token: 35	4780	powershell.exe
Token: 36	4780	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1360	4780	powershell.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-27_ef7eec5203bcf8922b67ec5021555fdd_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_ef7eec5203bcf8922b67ec5021555fdd_cobalt-strike_icedid_stealc.exe"
1⤵
PID:3052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sv.ps1"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\sv.exe
  "C:\Users\Admin\AppData\Local\Temp\sv.exe"
  2⤵
  - Executes dropped EXE
  PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_om3jjrva.m1i.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_om3jjrva.m1i.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sv.exe

Path C:\Users\Admin\AppData\Local\Temp\sv.exe
Size 1.6MB
SHA256 d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87
MD5 0673fca154b47e4158269b4eadd23689
SHA1 0456c056dfb21549163a48c2e9b10dd572c9924f
SHA512 fbd6a40dd177e579594e1de7cd1b1fe981b88472b1387cbe9d35ae2f50daf92b7bfc8cae4c5295f494781aa039ebba232ccc1a8c0ac0546fa9060e68789f7e70
SSDEEP 24576:1TWJIJuiuntlrN+q6kylxfvmspFMRw3k7OPMnGu2/Is6FXFo1AjEyHwdif5YoVoP:1TcIJhunddyj8RpaUnN2P0oyd8
TLSH
T1DD85AE17B29610EDC06EC179C7565112FA71BC840734BADF17A8AB252E22FD06F3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.ps1

Path C:\Users\Admin\AppData\Local\Temp\sv.ps1
Size 1KB
SHA256 1889ab904980ed0f9c5ac2bc788d165d252833e258e234b99cb21a9a1775b3ad
MD5 42c1473133b52dbd4a5800024635eccf
SHA1 9954e224e2fb91d3f66b3dd74d25954ae53edd9c
SHA512 b09fddfd629b33e16b7b9d017284fdd3c294c45c10969516b6df5d073a8b2f1be091959af176d45261270c06ee913d8aa71860884dca2b7b68e3c8e27560596c
TLSH
T11B4159429BF55140F7FB7B446A3E99200E76BC4A9E35D90D4199950E0AB2F218CB0F77
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4780-8-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-18-0x000001BCF7B30000-0x000001BCF7BE2000-memory.dmp

Download

memory/4780-1-0x00007FF97817F000-0x00007FF978180000-memory.dmp

Download

memory/4780-9-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-10-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-11-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-12-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-13-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-14-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-6-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-17-0x000001BCF7B10000-0x000001BCF7B2E000-memory.dmp

Download

memory/4780-19-0x000001BCF78F0000-0x000001BCF78FA000-memory.dmp

Download

memory/4780-3-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-20-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-21-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-22-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-2-0x000001BCF7840000-0x000001BCF7862000-memory.dmp

Download

memory/4780-33-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download

memory/4780-34-0x00007FF977FF0000-0x00007FF978994000-memory.dmp

Download