754c841852dcc0518b63782e68f13dd8493738d372fe9e0f8c4b2c408f4e1252

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 1.4MB
Sample260424-bmzalsa18n
SHA256 754c841852dcc0518b63782e68f13dd8493738d372fe9e0f8c4b2c408f4e1252
MD5 702acc82d734159e80797015664848f6
SHA1 d9e4617e43487b790908aa58a574d504af65de0e
SHA512 562268158eac89232bdd67315eb6493af47caec1f6cb09096a75045ef5803ce182fd944843b07661298f0deec2a3b8642633b44e66b09599fa7fcf875d99130e
SSDEEP 24576:F3y7SQrUU/oaIIpu8Y9kdoFZz4G8KrX+Il9EAUgWPwQTItUI4M13tRdl:JJJUQHIA5kdo7ZrBEUWPJIt337
TLSH
T13865020BA66940F9E1A7C274CD12590AD772FC564771AA8F13E44ED70F237A08E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
5	discord.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 2156	5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	86
PID 5796 wrote to memory of 2156	5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	86
PID 5796 wrote to memory of 5748	5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	89
PID 5796 wrote to memory of 5748	5796	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_cookies.json

Path C:\Users\Admin\AppData\Local\Temp\output\Chrome\Default\chrome_cookies.json
Size 349B
SHA256 9944ff9b892acd02b9de0643ef57c5e538984847e5fabd97a8215438be67ccb7
MD5 22524f795e123f0580c1b1b3ec5d61e2
SHA1 42bbdeb17ab01ccb087ad8b25ba00846c70574b3
SHA512 869cca1f4f49d9fb9282b6a677946fc709a883da9ef74ba42fbe3e109635ec96351702f9c53ecebb24ea58caadfff85796b57e13289c404911e79b79666a432f
TLSH
T10FE0685A59E12C1BC947C024E80245AC702462524619FEDA58B490564A00F2EB3674D7
MD5 SHA1 SHA512 TLSH

Submit Download

edge_cookies.json

Path C:\Users\Admin\AppData\Local\Temp\output\Edge\Default\edge_cookies.json
Size 312B
SHA256 281a89ab726b94957238f238408accdde891277f3abfcfc169bb955bd03f97da
MD5 f3f935c3ef630ceb4d47970bccea8d3d
SHA1 c054d3e565cd17d762da614b0acbbebb2b9b1491
SHA512 1925bf8a8994104c91dc65c4a8059450003624413e0d44e603fce9c377f5660f7a5603f93b39986bdb0827e8ad928f7f60c17eb3adfe71097b0c969c114aa6c6
TLSH
T15DE07D5C59CF815BC95BE6128C5146D47CAA2B12053DFE3FE0685464A9B151621074B6
MD5 SHA1 SHA512 TLSH

Submit Download