2ba0499e2c9d55bce8e2d1c57385a224dc978414632c0451f0c0323ed5ec54f0

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe
Size 530KB
Sample261027-eytfaacf59
SHA256 2ba0499e2c9d55bce8e2d1c57385a224dc978414632c0451f0c0323ed5ec54f0
MD5 e3b48f49f433e611993ad08930060e8f
SHA1 b5e05e4691e05edd783ab90de008319996f91a09
SHA512 c1d3d4c59d7b63a4f1f4bab14128a771a2346d4cc05bfe374d404d06ba976df7581ecde881f3ef702739c544fed62597eef5bd26f8e63d1c0fdf92edf4420c97
SSDEEP 6144:iPY18M+132S4QqMC7iP7SRSbjFe1KES0lK6foX3SbOSxby2grU/u25oQmF72znQY:qiHonwxWt16o0M2eCNsES7P2j2
TLSH
T1E4B46B46B2E598FED673C07AC5452A49AFB1BC16434CCCEB139089751EA38E0AF3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1612	payload_a_ece6f6ad.exe
1564	payload_b_9b819374.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1612	4812	2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe	85
PID 4812 wrote to memory of 1564	4812	2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3b48f49f433e611993ad08930060e8f_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\payload_a_ece6f6ad.exe
  "C:\Users\Admin\AppData\Local\Temp\payload_a_ece6f6ad.exe"
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\payload_b_9b819374.exe
  "C:\Users\Admin\AppData\Local\Temp\payload_b_9b819374.exe"
  2⤵
  - Executes dropped EXE
  PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

payload_a_ece6f6ad.exe

Path C:\Users\Admin\AppData\Local\Temp\payload_a_ece6f6ad.exe
Size 264KB
SHA256 4029fdd91be3abe8b229ba9cc6cd9a596fbf4e16ce75f1885911ad7749b90efe
MD5 f6eebdd5ca60332ca57205eeb55be27a
SHA1 3c3f102d17d646981db8bc439d490e087d0f7b88
SHA512 8660b740d69866fe795a58bfee5f459abe632a26526f72e1a6ca5b0664d68e4daa35db785352fc681ff4875bc7a3ea575cd2311e5b9fb1a41469d2952624d74b
SSDEEP 6144:8PY18M+132S4QqMC7iP7SRSbjFe1KES0lK6foX3SbOSxby2grU/u25oQQ:UiHonwxWt16or
TLSH
T1FE445B41A2E598FED663C07AC5892E89FBB17C55434CCCEB13908A651FA38D06F3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload_b_9b819374.exe

Path C:\Users\Admin\AppData\Local\Temp\payload_b_9b819374.exe
Size 261KB
SHA256 e3ef0a6ac66f974f357b464a0c507d699256de05faa2abe1312897d9288ccfa9
MD5 2deba96cf3c5a41eeb3080832708d4f0
SHA1 7473a5a2bf64bbfb9009e83e328068363770bc56
SHA512 b08b3ba0a26765a2a31ec5e70f7c71ad76fefb5aeab0532475e6d96598c4c67e8cf8f65a9b56ca3cf88cd01b045ac7618c28a3e24f0618c506ae80f607e03eb1
SSDEEP 6144:dF72znQE9j9K+AQNs4BaSyewabaRPkiu/tb9aXErcAk5xYjeCW1EsEv7m7Pezj2:IM2eCNsES7P2j2
TLSH
T157445A06B2E558FED773C0BAD90612069EB1BC164748CDFB139089761EA78E1AF3DB11
MD5 SHA1 SHA512 SSDEEP TLSH