Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/05/2026, 10:11

General

  • Target
    2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  • Size 1.4MB
  • Sample260517-l8ehfaex91
  • SHA256 9e4b6c3d77885fb55bc781b3ae43d36e5437729a90eb62024f70e1e59cf773a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealcw.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealcw.exe" --supervisor --main-pid 4752 --main-exe "C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe" --generation 4752-240654937 --nonce 9850188331743883325 --path-hash 2727289915714931644
      2⤵
      • Executes dropped EXE
      PID:4380

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealcw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-05-17_6de25cae18b24be1685e94f31781edf0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealcw.exe
        • Size 1.4MB
        • SHA256 9e4b6c3d77885fb55bc781b3ae43d36e5437729a90eb62024f70e1e59cf773a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 a29edbc68904ceff3f05d4d23e65b4ea6cc168b8de20a76a59c645fa91a5f436
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 15bc5664835ab5cdae07656265946686f10f5143e6d3d0ffadf12b777c319964
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 4bd274e65dc933703aa5a707d54f4f77522677870e753b5c68b17c8f16cb2ad3
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 45df4b622cd29ad81e481bd1c18da6816c5c654935d480a99b6c01528a690931
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 80814a4dd276b7619577eeb6cfe1b00ddbf30b4e12519c1e0500656b3f8873b7
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 d8fa6c91208d9214b288d4596512667b184971cabff1d78f3ba9f8fdda7de770
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 56a1acee1739fc48fffce05dde9471149f94145f022a433e4874236ec8771bbd
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 05c1504d121bbca6ecd20575d57f5083fb1df763a0f02026b32e5582c229cc63
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 172c8853f4e4ff42a30b6a1574d0b7186cf396d59d28186de0ead1f2c9c47f6b
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 3f5a225185f8f36ed8ee6edd6d3d9fa211ac6608242bc54f6c775f8b6dcf51e0
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 4fd87e4e204bc22a8a35d643c13b4bcdd646459c0e9b37c048bc96914d0135e5
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 e0d1457daeba5853cc7826e80a48f32a1fc427279c8337ed019371dd9ab0e484
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 67be1f5af4651ae331261689af85674f41dedfe7e262569f12b76aedc3d7f6a5
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 82016a2cb4c8d6ecb36e471f6b89ebc55db50d659fc92b53b40baf8f14d60b26
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 e847e61a161a22414a4944ee3a0b9775824543addd5287eceda389bb261d8078
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 753c6e72c8f2702dbe422f6af90f96b2d8851efd11332649becaa61b0ded3cf3
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 6c5f2c600b0e6ff4b701331937db714d8d442ebf9c363a42fb10ef436e777b7e
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 705bcf791e7fc154027df6c3208164eb1aabfffbd41cc2024fa0bc60775d77cd
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 46769f685b9109b673e0a66466d8040cd75bd3cba8e96842ef40e2cf3691c47c
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 51e6178e9265358664faa951b5c8021fc505c61d3cf1d2947ae0c36a4c7ef4e2
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 092884687bc0641cceb0d2f161da040c87a436b4c59f2b193a654baf1e60b530
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 7d0b903017b3b89ca6e71f97c1efa486035782733f84bb29c7a2e1b2325d25ce
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 aa8ae2303a7687f1dcf4907ab6e1619619631374293e6a53e5a32bda3cba5c9e
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 068448e55de3a72743cd4dcbc50b2f207f7e51a833515b3e720a60d431545ba6
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 21b9430bf8cad24755efd2739df80e8a691da3df686baed8b659c3e16e818675
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 c9985e107201102e69159fc5d4058f3135fb6336dbcda1dc15df365a6020687f
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 267cebe5c2edef9e71de7e8f16c3c8bbbc358a1a7735f5742c902b06f271c5a4
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 a02c1b967f4aaf9060955284845e0971df27ccb563d97ab93e1c853c20937e59
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 15dbd99a77beecf08bedf3b5c2e9115925e93e625c05b8ca72e4db128583820f
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 a83d3cd934b8d050eae2d115390f28167e17dbe154597eff6aa49a8b1c65a083
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 e615ef057afc006ac5f0df6a0be2e6c17477dbcb87ca0fa472e5b36fdf5818ce
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 19ac937eec3d482e0d22e0453d4814468e402f5aad8bdea0465e1e6166a3ad91
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 f5b77e4051da6f74db26dbd950a1583ba64dc545dfd8aa5bd6514a77f20e740e
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 77eb4c81261f0642c97e227db3f7a8cf2bfd992594c567824fa9bb0a86129a81
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 1bd240dc73d3f96bb5b1163a83e42d4cb8d6bdf31fd1ff138f49d81e57e11f1a
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 8e9a177a0a1c87046b9e76e8cae99bc6a55475c44fb50a06ee42ecd5faccf0cd
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 20c5833da2518a50e7326513b21d035f5819d8be83b61a62435aa44b7f1da36e
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 48445c1dce328ba06c21bcbbfd29a8bf9158b4cab2d72263eae1dd5c5ee2b299
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 579a993d0dde81338e83b54a3a0bf5075b3f7029c13c9ab0e3c37078e6473b41
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 1216dbe5e3134330bfeca0aaf4cdf9b80acc6b5c5c45603cde6355b01485c4fc
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 0c5b1ee149be44c8bc8b72d7d9e5d5f303ff69f0df902b0b296366e92e31f9a6
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 1eac037770cbdbe580b06a112124633a09a6537ac73e43dd6474321462e36ae2
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 02f47d0532bdd3f851612b8db57e4e36358ce3a21b02a8943b6490ad9900a745
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 e41b6c73bf85bbb5a8d5d0b4178137ab057c6c86738d574288e5b3efe7b00738
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 4c629c4d2cdf0bbbd8e9b9c5fa04801795126b4e00ae2158f43f0b5b0e6ef143
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 6fd59131b96a54754a3afbe70ea909d791687a644b7ec4eab217d4fea064ebef
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 1d7eafe2f481669c28a4d60e4f392d231d62553dcdd35892b0451290d65fa35a
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 b5b1e021c69dabccb03627edf9f7329d24460839ebd74c91374bde3d050badb8
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 04cac49dc64a909346d5485ee77515c377e1121df77519d43014cced4bc7789f
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 69843e4b65f076488bf3f32e9687dadf7646bd6767fe475fe3c0a3b1a74812a3
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 a6f8536ae1790387589748b8087a19dbe48d8f82cf95b4e83ea2a7343e50b7c8
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 3cee1735e014de92218f965fc4a4d13e69efe700bf6fe82dbf5bfdef5f0b1517
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 bf71d27e2cb818dd1e0e53d1bbdc358797ef17739a50dae7ad74d62236ce06d0
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 8197614f3e094ae1827c46f24b28f1de2352111fd8b68bfc88e2e5787b4b6046
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 c767ebdb62abcf306dac25b8bc3481a679a13128408d97ac559f992da00f56fe
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 85a2036b42215ea3b1f375e10b95964f0a91739e00ce86a2ebe13aaae29fa29e
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 7a76d2faddd2b75ae798d3698d7e0aba731bf0734033df7bac7e96a20666862f
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 fabe8c32d64a24789f329c41b5600b6c6df065279279faac587afab79ed3d3f0
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 480554ba17f0ac9ac2246873f85ddab96ab2105b9468acdd9bdf7c9bb5f1409c
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 c4b25f9fd9f26e17eefd9256c698e467f79014a1c904f292a7089d2b3dde59a7
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 395ffb0ba248d79ca015c60a6b6396f3bf338ae0bda3f432434dc252c07cc4e5
        • MD5 SHA1 SHA512 TLSH

        pq_main_heartbeat_4752.state

        • Path C:\Users\Admin\AppData\Local\Temp\pq_main_heartbeat_4752.state
        • Size 65B
        • SHA256 2c5d69f926d39bbe1775b23a1862357192652d3c27b4bbad76d1de4bfde2ee4b
        • MD5 SHA1 SHA512 TLSH