Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 02:31
General
- Target 2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe
- Size 2.4MB
- Sample260522-cz55csfv91
- SHA256 7dd92ced1986f4ba672e66cc0020c576e5b67e25c18038dbec5a1b9ecd99faca
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- detects Windows exceutables potentially bypassing UAC using eventvwr.exe 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\winver.exeC:\Windows\system32\winver.exe2⤵
-
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_252974a2f7445e509c16cc9f202cec2a_cobalt-strike_icedid_njrat_satacom.exe" --payload3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsTasks'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\WindowsTasks\SystemMonitor.exe"C:\ProgramData\WindowsTasks\SystemMonitor.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /query /tn "WindowsUpdate"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /tr "\"C:\ProgramData\WindowsTasks\SystemMonitor.exe\"" /sc onlogon /rl highest /f /delay 0000:155⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /query /tn "WindowsUpdate" /fo csv /v5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\ProgramData\WindowsTasks\SystemMonitor.exe"C:\ProgramData\WindowsTasks\SystemMonitor.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SystemMonitor.exe
aforge.dll
aforge.video.directshow.dll
aforge.video.dll
costura.dll
costura.pdb
e_sqlite3.dll
messagepack.annotations.dll
messagepack.dll
microsoft.bcl.asyncinterfaces.dll
microsoft.data.sqlite.dll
microsoft.net.stringtools.dll
rsquare.common.dll
sqlitepclraw.batteries_v2.dll
sqlitepclraw.core.dll
sqlitepclraw.provider.dynamic_cdecl.dll
system.buffers.dll
system.collections.immutable.dll
system.diagnostics.diagnosticsource.dll
system.io.pipelines.dll
system.memory.dll
system.numerics.vectors.dll
system.runtime.compilerservices.unsafe.dll
system.text.encodings.web.dll
system.text.json.dll
system.threading.tasks.extensions.dll
system.valuetuple.dll
__PSScriptPolicyTest_suwke51q.yem.ps1
memory/2380-2-0x00000209A3570000-0x00000209A3592000-memory.dmp
memory/2380-0-0x00000209A3530000-0x00000209A3540000-memory.dmp
memory/2380-1-0x00000209A3530000-0x00000209A3540000-memory.dmp
memory/4188-158-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/4188-24-0x0000000000A00000-0x0000000000C3E000-memory.dmp
memory/4188-159-0x0000000005B60000-0x0000000005B7A000-memory.dmp
memory/4188-160-0x00000000061D0000-0x0000000006774000-memory.dmp
memory/4188-164-0x0000000005CD0000-0x0000000005D32000-memory.dmp
memory/4188-167-0x0000000005CB0000-0x0000000005CCA000-memory.dmp
memory/4188-168-0x0000000005D90000-0x0000000005DE0000-memory.dmp
memory/4188-169-0x0000000005E80000-0x0000000005F12000-memory.dmp
memory/4188-155-0x0000000005AF0000-0x0000000005B40000-memory.dmp
memory/4188-180-0x0000000005520000-0x000000000552A000-memory.dmp