754c841852dcc0518b63782e68f13dd8493738d372fe9e0f8c4b2c408f4e1252

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 1.4MB
Sample260424-bmzalsa18n
SHA256 754c841852dcc0518b63782e68f13dd8493738d372fe9e0f8c4b2c408f4e1252
MD5 702acc82d734159e80797015664848f6
SHA1 d9e4617e43487b790908aa58a574d504af65de0e
SHA512 562268158eac89232bdd67315eb6493af47caec1f6cb09096a75045ef5803ce182fd944843b07661298f0deec2a3b8642633b44e66b09599fa7fcf875d99130e
SSDEEP 24576:F3y7SQrUU/oaIIpu8Y9kdoFZz4G8KrX+Il9EAUgWPwQTItUI4M13tRdl:JJJUQHIA5kdo7ZrBEUWPJIt337
TLSH
T13865020BA66940F9E1A7C274CD12590AD772FC564771AA8F13E44ED70F237A08E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1300	5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	79
PID 5052 wrote to memory of 1300	5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	79
PID 5052 wrote to memory of 2688	5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	82
PID 5052 wrote to memory of 2688	5052	2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_702acc82d734159e80797015664848f6_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_cookies.json

Path C:\Users\Admin\AppData\Local\Temp\output\Chrome\Default\chrome_cookies.json
Size 349B
SHA256 ff1b11a3268fb1154cfd323c2c0b9506910b4d34a31b2d473ce3ca29b9692c1f
MD5 ff2004c15b868831549c32d280328003
SHA1 4dc208ef5acc7f55ded0a8392de9c3521d4759b2
SHA512 f10d501bef49e2b444ef9180e885c8d22d7f9d54d7c10655d68b7d1c9d3d0b37ceddd37beb48b298acd4628dd6229ec88e6a1a7cf571f542b3e9f62adc70234b
TLSH
T150E0280C00DD72B2FE26517665010DD8BC6C41111095ECC77A1C34145C10B5E71414DA
MD5 SHA1 SHA512 TLSH

Submit Download

edge_cookies.json

Path C:\Users\Admin\AppData\Local\Temp\output\Edge\Default\edge_cookies.json
Size 312B
SHA256 229efd23b608aa7ec0417586d4ea83be43e8f2638dd1201657e2ed89a88cbba1
MD5 dc66c7c84f7e5040c913810fa9e4309e
SHA1 b52242ce06932ac21ac640fac16f02204c6fd109
SHA512 db3fa624e0e38f579744b481fdaf0c1e7b6d4b2d54a68fa5145543405a79ee7fbf3639588a01099bd82b8251015e3b984d5bc4964ae29ab1fe98ddf0c9821da6
TLSH
T1C5E07D18B4DE4867CA0D4A603EB11B4DB56C3A57821CFC9C14914A34DCE655632B918B
MD5 SHA1 SHA512 TLSH

Submit Download