ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d

Analysis

max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe
Size 383KB
Sample261102-gr4nsafs3x
SHA256 ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d
MD5 e01dcb8f26ca34dc3fd059e052931968
SHA1 15175456632d56d68c13f427e4e251c0f3e7d5ce
SHA512 fe052a10c70a34bf0bdbf166c36fdbe50d337fe73f3e351736ed56622092a4b7ad6e29ab13168bfe331a7a546febffc8715e32df574907240e587c2ceddec42f
SSDEEP 6144:rdL6RkzYBf70/hpLIG1C6cUmQvZB4v8INYch9HRg6gYZEQV5vrhU09NxChMBQ6:B6HTgpHsQmDNXrH1ZNd7K
TLSH
T15C844A15FA5618ECE056C13482568972A97278CE0B31ADFF22D842383F7ABF55E3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "83"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2788	reg.exe
Token: SeRestorePrivilege	2208	reg.exe
Token: SeRestorePrivilege	636	reg.exe
Token: SeShutdownPrivilege	3512	shutdown.exe
Token: SeRemoteShutdownPrivilege	3512	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5364	LogonUI.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2788	4144	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	87
PID 4144 wrote to memory of 2208	4144	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	88
PID 4144 wrote to memory of 636	4144	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	89
PID 4144 wrote to memory of 2336	4144	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	90
PID 4144 wrote to memory of 3512	4144	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\reg.exe
  "reg.exe" unload HKLM\HSX_OFF_SYS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\reg.exe
  "reg.exe" unload HKLM\HSX_OFF_SOFT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\system32\reg.exe
  "reg.exe" load HKLM\HSX_OFF_SYS C:\Windows\System32\config\SYSTEM
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- C:\Windows\System32\sfc.exe
  "C:\Windows\System32\sfc.exe" /scannow /offbootdir=C:\ /offwindir=C:\Windows
  2⤵
  PID:2336
- C:\Windows\system32\shutdown.exe
  "shutdown.exe" /r /t 0 /f
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3512

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5364

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads