Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/11/2026, 02:21
General
- Target 2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar.exe
- Size 227KB
- Sample261113-cs7dvaft2p
- SHA256 c191000d6a76557d85c72f3bdcc1b6472cd988d1c62f56853ab54c3d84607cca
Malware Config
Signatures
- Custom signatureDetects Reflective DLL injection artifacts 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\syshost.exeC:\Users\Admin\AppData\Roaming\syshost.exe3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
syshost.exe
memory/3276-6-0x0000000003350000-0x0000000003371000-memory.dmp
memory/3276-7-0x0000000004D50000-0x0000000004D75000-memory.dmp
memory/3276-9-0x0000000004D50000-0x0000000004D75000-memory.dmp
memory/3276-10-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/3276-11-0x0000000004D50000-0x0000000004D75000-memory.dmp
memory/3276-13-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-12-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-15-0x00007FF8A06B2000-0x00007FF8A06B3000-memory.dmp
memory/3276-14-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-16-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-23-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-22-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-27-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-26-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-25-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-24-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-21-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-20-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-19-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-18-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-17-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-28-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-31-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-34-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-33-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-35-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-32-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-30-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-29-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-37-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-39-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-36-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-40-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-38-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-41-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-42-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-44-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-43-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-45-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-46-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-48-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-50-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-49-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-51-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-53-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-54-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-52-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-47-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-55-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-56-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-58-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-59-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-57-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-62-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-64-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-65-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-63-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-60-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-61-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-67-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-69-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-68-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-66-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-70-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-72-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-73-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-71-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-75-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-74-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-77-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-76-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-78-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-81-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-80-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-79-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-83-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-82-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-84-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-85-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-87-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-86-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-91-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-92-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-93-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-88-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-90-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-89-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-95-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-94-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-97-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-99-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-100-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-98-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-96-0x00007FF8A0610000-0x00007FF8A0717000-memory.dmp
memory/3276-101-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-102-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-103-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-104-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-105-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-106-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-107-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-108-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-112-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-111-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-110-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-109-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/3276-113-0x0000000000FA0000-0x0000000000FB0000-memory.dmp