Analysis
- max time kernel
149s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 14:08
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 7.3MB
- Sample260523-rfynhadt2z
- SHA256 1e3fad5178cde230e21a19f6a37f4eed2e5690319a411cb4f323eede73488905
- MD5 04741f399456e41391114f83d0548a20
- SHA1 8516101ad71eb879105aa4a561ee4871521592d8
- SHA512 e4cd226ecd1ec6d140eeec2fa05d11b9ed2457231cbe7d625e054c5039708121f38df55acb30211c02d22f2169860b1338f55679fc869b71253db9ab3ba268e9
- SSDEEP 98304:YSoKVCrmamPkNBCvanOulxFFeKCSN5rfwd6/e0KSA9:YSrkr48rcNCFVCgtOd9
- TLSH T10A76CF16B2A540F8C0B7C5B48A265A23EAB17C5403319BDF17E09A196F37BF16E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3420 3003204645206244.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3003204645206244.exe - Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\Content Type = "Application/xml" 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3003204645206244.exe --run %1" 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 3003204645206244.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\ = "Xenos injection profile" 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3003204645206244.exe --load %1" 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\ = "Run" 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 3003204645206244.exe Key created \Registry\User\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\NotificationData 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 3003204645206244.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\ = "XenosProfile" 3003204645206244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3003204645206244.exe,-135" 3003204645206244.exe Set value (data) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 3003204645206244.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit 3003204645206244.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 3003204645206244.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1864 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 1864 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 1864 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 1864 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3420 3003204645206244.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3420 3003204645206244.exe Token: SeLoadDriverPrivilege 3420 3003204645206244.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3420 3003204645206244.exe 3420 3003204645206244.exe 3420 3003204645206244.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1864 wrote to memory of 3420 1864 2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_04741f399456e41391114f83d0548a20_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3003204645206244.exe"C:\Users\Admin\AppData\Local\Temp\3003204645206244.exe" --binder-child2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3420
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3003204645206244.exe
- Size 1.1MB
- SHA256 8bdb3ce10dee7a3249a186050d7f804bca19859f292ddad7ae8c5afbb649a07b
- MD5 216c3eae24901482bfd26cb9dca1a833
- SHA1 f6000cc06cbc9f0e748b81cfac77eb2598f71e69
- SHA512 74cf449facf674c6cb6b5831830a598038ae09bc088da8af894fe79462b48ad02222a2d931233f731187c163c7629a920488efdd1f58692c4f3c9a64d1497a17
- SSDEEP 24576:gwTJ6A1eP1Pm9zhTaUe0K9XXVYFEjd6/Gr+AK9hhEfSVgPCS3tMrMyj3F9hIF1SR:r5ra0K9ndjd6/GXKvhISVE3tMx3FE1Sr
- TLSH T1B1459D1272C580B2E17202305E7D9B768AFDBD240B2196DF67846B2D9F34FD22D36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 1KB
- SHA256 085b3101b885a754938f32cde6328089f2e70096d8e8b832dd0bc3e989b94252
- MD5 f15db528dac70f99ca78641c0eae25a8
- SHA1 5934f07991ecc018bd180962ec0876a46e4735a6
- SHA512 98030425033065b1f6ce0eb0cb70ad13ee99e4a9864e6b7f32d23500dd1204e7dbd6f84d73c1227e59936df97ba552ec6376ff5661ea3eebcf4e1e2e2017e1ad
- TLSH T1AE31CB1323F8205382694B89E3A7096B3D9573215B8D7F84772CDB990948CE318DE6E5
- MD5 SHA1 SHA512 TLSH