Analysis
- max time kernel
150s - max time network
159s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 01:05
General
- Target 2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 322KB
- Sample260424-bfxhfaaz2q
- SHA256 efc9915ad2f81995ae5fbe120097d794495cd8c8f0cbc62b599a2aa6f74faf9c
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_18c29211b68bbec6185e01d3ea2b3d14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\_986657152\Defcyglaunch.exe.exeC:\Users\Admin\AppData\Local\Programs\_986657152\Defcyglaunch.exe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Defcyglaunch.exe.exe
fedWindows.Storage.Search.dll
memory/2784-0-0x000001E4DC5D0000-0x000001E4DC67E000-memory.dmp
memory/2784-244-0x000001E4DC5D0000-0x000001E4DC67E000-memory.dmp
memory/2784-245-0x000001E4DE4F0000-0x000001E4DE4FC000-memory.dmp