Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 06:40
General
- Target 2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom.exe
- Size 2.4MB
- Sample261027-he7eksbz8r
- SHA256 449f9b5bf9ab1718842f681b4f68986444ef4b360648608a886ec0e9baeb1535
Malware Config
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_cbed7c60caa4a9b40ab8b7db71f5464c_cobalt-strike_icedid_ryuk_satacom.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4308-3-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-6-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-5-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-4-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-1-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-7-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-0-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-2-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-23-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-33-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-27-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-34-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-35-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-31-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-30-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-12-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-11-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-10-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-9-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-28-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-26-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-25-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-8-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-22-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-21-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-20-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-19-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-18-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-17-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-16-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-14-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-13-0x0000000003810000-0x00000000038B4000-memory.dmp
memory/4308-36-0x0000000003810000-0x00000000038B4000-memory.dmp