Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:26
General
- Target 2026-11-01_c382441178a0885b8006bb5121d638cd_cobalt-strike_icedid_ryuk_satacom.exe
- Size 214KB
- Sample261102-lea8xsstcs
- SHA256 dd17e898115569d4f3fbdac0b4364583393bb4f078dbd8dcce8ce4c233f45a61
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c382441178a0885b8006bb5121d638cd_cobalt-strike_icedid_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c382441178a0885b8006bb5121d638cd_cobalt-strike_icedid_ryuk_satacom.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Users\Admin\AppData\Local\iCUE\iCUE.exe"C:\Users\Admin\AppData\Local\iCUE\iCUE.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
crypter_marker.txt
iCUE.exe
memory/4304-3-0x00007FF982380000-0x00007FF9825E3000-memory.dmp
memory/4304-13-0x00007FF982380000-0x00007FF9825E3000-memory.dmp
memory/4304-29-0x0000000140000000-0x0000000140048000-memory.dmp
memory/4304-32-0x00007FF982380000-0x00007FF9825E3000-memory.dmp
memory/5052-4-0x00000000001E0000-0x00000000001E4000-memory.dmp
memory/5052-8-0x00007FF9824DF000-0x00007FF9824E0000-memory.dmp
memory/5052-2-0x00007FF982380000-0x00007FF9825E3000-memory.dmp