Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 22:13
General
- Target 2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe
- Size 205KB
- Sample261030-15f97afv4s
- SHA256 8046caa3881073dbbbc47df4e6bb69b318155a77015aefe7c9cf0b10d58d8369
Malware Config
Signatures
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 9 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe" --autorun1⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-10-30_90bdc9257e2d88973b9f591dbed9626a_cobalt-strike_icedid_satacom_stealc.exe1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1
AFILTER
ANETWORK
GROUP
INSTALL_TIME
index.dat
REMARK
memory/836-0-0x0000022E96E70000-0x0000022E96E75000-memory.dmp
memory/836-31-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-35-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-36-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-37-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-7-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-51-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-67-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-1-0x0000022E96E70000-0x0000022E96E75000-memory.dmp
memory/836-85-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp
memory/836-86-0x0000022E99B60000-0x0000022E99C0E000-memory.dmp