Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 14:08
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 7.3MB
- Sample260523-rfynhadt2z
- SHA256 1e3fad5178cde230e21a19f6a37f4eed2e5690319a411cb4f323eede73488905
- MD5 04741f399456e41391114f83d0548a20
- SHA1 8516101ad71eb879105aa4a561ee4871521592d8
- SHA512 e4cd226ecd1ec6d140eeec2fa05d11b9ed2457231cbe7d625e054c5039708121f38df55acb30211c02d22f2169860b1338f55679fc869b71253db9ab3ba268e9
- SSDEEP 98304:YSoKVCrmamPkNBCvanOulxFFeKCSN5rfwd6/e0KSA9:YSrkr48rcNCFVCgtOd9
- TLSH T10A76CF16B2A540F8C0B7C5B48A265A23EAB17C5403319BDF17E09A196F37BF16E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Executes dropped EXE 1 IoCs
pid Process 4692 1606402434146553.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1606402434146553.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\ = "XenosProfile" 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\ = "Xenos injection profile" 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\ = "Run" 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1606402434146553.exe,-135" 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings 1606402434146553.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 1606402434146553.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1606402434146553.exe --load %1" 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1606402434146553.exe --run %1" 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon 1606402434146553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\Content Type = "Application/xml" 1606402434146553.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 1606402434146553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 1606402434146553.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff 1606402434146553.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 548 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 548 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 548 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 548 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4692 1606402434146553.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4692 1606402434146553.exe Token: SeLoadDriverPrivilege 4692 1606402434146553.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4692 1606402434146553.exe 4692 1606402434146553.exe 4692 1606402434146553.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 548 wrote to memory of 4692 548 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\1606402434146553.exe"C:\Users\Admin\AppData\Local\Temp\1606402434146553.exe" --binder-child2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4692
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1606402434146553.exe
- Size 1.1MB
- SHA256 8bdb3ce10dee7a3249a186050d7f804bca19859f292ddad7ae8c5afbb649a07b
- MD5 216c3eae24901482bfd26cb9dca1a833
- SHA1 f6000cc06cbc9f0e748b81cfac77eb2598f71e69
- SHA512 74cf449facf674c6cb6b5831830a598038ae09bc088da8af894fe79462b48ad02222a2d931233f731187c163c7629a920488efdd1f58692c4f3c9a64d1497a17
- SSDEEP 24576:gwTJ6A1eP1Pm9zhTaUe0K9XXVYFEjd6/Gr+AK9hhEfSVgPCS3tMrMyj3F9hIF1SR:r5ra0K9ndjd6/GXKvhISVE3tMx3FE1Sr
- TLSH T1B1459D1272C580B2E17202305E7D9B768AFDBD240B2196DF67846B2D9F34FD22D36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 1KB
- SHA256 d9fa3cce76c9703e56ebcbcfe0c99787b99a19f10ed2e67fd6ba2251ac570e3d
- MD5 bf70b221fb751c7798c57a4fdcbde775
- SHA1 1759e7d7faf37fe6b6c4b76d1c21659c87df4360
- SHA512 2545dd687fd1561805a69a6af79e6795bfc4b1ae5c4b35d7f5e599ddb861aaad7e5260906887cdbdef1a1db69f5a1c43af03a22a7d98d4ffa20cf2dc46e7c607
- TLSH T11931E71323FA2043865A4745E35B096B3D957131DA897F8873ACC78B0949CE318EE7E5
- MD5 SHA1 SHA512 TLSH