Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 322KB
- Sample260424-bfxhfaaz2q
- SHA256 efc9915ad2f81995ae5fbe120097d794495cd8c8f0cbc62b599a2aa6f74faf9c
- MD5 18c29211b68bbec6185e01d3ea2b3d14
- SHA1 6857677ca7e3de675953add81aff55d181c1ef3b
- SHA512 720c07c86b8ef0e044b6db384e220ac4e380ca2b260967ccb2a25326d659b6a020cc5946e3cee3fa5bf06d63bf795a24d3a7418422edfeae81f60794166d7692
- SSDEEP 3072:SmTdeUzRJ5CjfyXWZTy181sIROOl2dZtX1SfAGX8B0SaWwSDHv2EsvVBkTvOtBvy:Sq4UB1eAGX8690OZFc+3foutT
- TLSH T180643B4AF6A520F5E5BBD13CC942650AFA717C624770A7CB67900A9B2F23BE09D3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 14 4520 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 14 4520 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Executes dropped EXE 1 IoCs
pid Process 384 Defcyglaunch.exe.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 4520 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
C:\Users\Admin\AppData\Local\Programs\_714352415\Defcyglaunch.exe.exeC:\Users\Admin\AppData\Local\Programs\_714352415\Defcyglaunch.exe.exe1⤵
- Executes dropped EXE
PID:384
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Programs\_714352415\Defcyglaunch.exe.exe
- Size 497KB
- SHA256 5e77c5c0f855a8606698d62fe38ca6dcc2a7030f995b3bedeac4aa546837ea10
- MD5 20d503657309cee5ef602ba833338580
- SHA1 50a8512e3f6ce5bf1ff697261bbefc9bc353a9ca
- SHA512 e0c5f4874335884d2805f3fb75aa3e920bf3a1f13638f4c4bac55683a17ecdc81d6b2315738fc00f6db463c0728dc0c3e828ae96ebe988c1f7890462c54d0dbc
- SSDEEP 6144:3rA+xXmfAfBn2cAMrjEnmjOe7fOOWWXhro59ztYot8gXlCzG:3rAKpn2c8RGaWXhroXt9pXB
- TLSH T1EDB47D55B79800F9E1B7C179CD938946EBB1781507A0A7CF03A4DA762F23AE04E3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\_714352415\wbem\fedWUDFx02000.dll
- Size 1.6MB
- SHA256 a1331a9b4c8cca6ccdda97efa7b57fe249cb1753b0ee9c212a41856866c21b23
- MD5 f804d60514ec31233e6df99949b7ff1e
- SHA1 96d48b58e741a33d6729d4d2ae57f7f52a0d4961
- SHA512 fa60f5ea399a316946dd35c0c346ff6cf19e76d905055f4473f11edd47dae937efe2482ef4a0bb435aaf68d4aa29ead23c538231f66d2a58499d79547341f58a
- SSDEEP 24576:TNjNU+J4wogYQIA4wPrfZk9BFAoUXlJJBwuCx59U4IgL5pQ:h94wogYQIA4qrfqIokPJBwuOTU4IJ
- TLSH T125855B1EB768C096C83A42358853C275D6B17C305B6066DB62D0FB7FBA33BD16A3A705
- MD5 SHA1 SHA512 SSDEEP TLSH