d594bbf60894b08733f6b8545ce48cd540fa8a49439db0a3ea63a97f94d37c7e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 26.0MB
Sample260527-tymp3aev6v
SHA256 d594bbf60894b08733f6b8545ce48cd540fa8a49439db0a3ea63a97f94d37c7e
MD5 e8164aebdf106d34eb4e684590cdb940
SHA1 55742314fea851fead5bf15739bd890e87efd1e8
SHA512 5e67728732a214fabe066a6e2915444c083cc47978fa73d6c4d231bd501abaeaf737700d19d7b08409e1c670513b00e093e1e05da2a83ed4ff0f22442275bf88
SSDEEP 3072:HC72o0130OyWzl0TuEu/SZqkmM6MsQleHqAnf7NLf8QjPbDCCOpP6wrHRthml8E6:HC72lze7uqZqkmMVtl6qMfZTnCdDA
TLSH
T16A576D1AF7A514F9E9A7953CC8424906DA72BC574760E7CF03A04A973F236D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022c04-28.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022c04-28.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022c04-28.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022c04-28.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022c04-28.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe
360	powershell.exe
1200	powershell.exe
1348	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
46	2500	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1688	netsh.exe
4224	netsh.exe
3212	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4872	sertja.exe
3076	sertja.exe
4740	sertja.exe
4764	sertja.exe
3624	sertja.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\sertja.exe"	sertja.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\sertja.exe"	sertja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\sertja.exe"	sertja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	57	Go-http-client/1.1
HTTP User-Agent header	75	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1044	schtasks.exe
4784	schtasks.exe
3872	schtasks.exe
4532	schtasks.exe
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4760	powershell.exe
4760	powershell.exe
360	powershell.exe
360	powershell.exe
4872	sertja.exe
1348	powershell.exe
1348	powershell.exe
1200	powershell.exe
1200	powershell.exe
1200	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	sertja.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3568	2500	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 2500 wrote to memory of 4760	2500	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	99
PID 2500 wrote to memory of 360	2500	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	101
PID 2500 wrote to memory of 4872	2500	2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	110
PID 4872 wrote to memory of 1348	4872	sertja.exe	113
PID 4872 wrote to memory of 4784	4872	sertja.exe	115
PID 4872 wrote to memory of 3872	4872	sertja.exe	118
PID 4872 wrote to memory of 4532	4872	sertja.exe	120
PID 4872 wrote to memory of 1688	4872	sertja.exe	122
PID 4872 wrote to memory of 1200	4872	sertja.exe	123
PID 4872 wrote to memory of 4720	4872	sertja.exe	128
PID 4872 wrote to memory of 4224	4872	sertja.exe	132
PID 4872 wrote to memory of 1044	4872	sertja.exe	134
PID 4872 wrote to memory of 3212	4872	sertja.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_e8164aebdf106d34eb4e684590cdb940_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\avuekpve'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:360
- C:\Users\Admin\AppData\Local\avuekpve\sertja.exe
  "C:\Users\Admin\AppData\Local\avuekpve\sertja.exe"
  2⤵
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe';$s.WindowStyle=7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc ONSTART /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule "name=RemoteX Client"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\sertja.exe';$s.WindowStyle=7;$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\sertja.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4720
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\avuekpve\sertja.exe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\sertja.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\avuekpve\sertja.exe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3212

C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
1⤵
- Executes dropped EXE
PID:3076

C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\sertja.exe"
1⤵
- Executes dropped EXE
PID:4740

C:\ProgramData\Microsoft\Windows\sertja.exe
C:\ProgramData\Microsoft\Windows\sertja.exe
1⤵
- Executes dropped EXE
PID:4764

C:\ProgramData\Microsoft\Windows\sertja.exe
"C:\ProgramData\Microsoft\Windows\sertja.exe"
1⤵
- Executes dropped EXE
PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bcf3ba98af6ee96a3eba9bbc6bdb2ae36b883f5f1e9cdad2974cbbcb9c102237
MD5 354ebb8d437ee057dacfef36baced4e9
SHA1 30460dbe64847ebb524d7d1fd5b9bf8a851a7626
SHA512 1f2cb272ad33df6e34949ac4d60ec0702316d9e21992be52cd9c6abd846472e7c868a8e96b5922b016e7952e460671e5768d007e28d84940a1b956eef4705b53
TLSH
T16D112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48
MD5 be67063c62a242565760a02a642a9f02
SHA1 d1043a892b44d6676f71b568f578fff947266a19
SHA512 90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638
TLSH
T174112223F38C8920CC96153A509DAC5172B586CB81EFDE9F7FC0D210A1BF584CBA1194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c009b20545c501a383a6863679d07a4816af60593db9493f3f3eb67c5ca9f5df
MD5 f513615cfe3418b74fe10396c39251f2
SHA1 83f716b018b0cdbf6e53e390ab417e711dfd9739
SHA512 3e3e8c279c8e1afa235c2e13ce8c1a76fde4c7f23db1322039911e2a8434bba9eb19cb6ecff33456dface6bc43d740433966872f42b6c76a4bdaaca1a2edd4c5
TLSH
T15F115337B39C89A1CC86163A409DAC1172B683C741AEDEDF6BC0C214E1AF584CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zbzi3u1a.vl5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbzi3u1a.vl5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sertja.exe

Path C:\Users\Admin\AppData\Local\avuekpve\sertja.exe
Size 19.6MB
SHA256 4d6b7e54dbe5dd99761ea72e7dd9bfbac319f93853c021a96ffb3de0c08bb9cf
MD5 6247a55b51a19efbb254b3b2206bb4be
SHA1 022abe713e17cadb4ea398e73050223054d0fa19
SHA512 9642d478ca4348d407f53e2c35e6dcca218ba23b8fb76d9cac1874a55901a8658804312b83dfb170cda40d01203979da3cb7de04a0937770cecd833545fc2d56
SSDEEP 393216:1Tph6pH92xPZZSjZ/DSNEdXMw1s5bR+8e:1Tph6pH9iqZ7RXDs5bR+/
TLSH
T1A7279D47ECA545E4C0AA9135CA669267BB717C884F3163C72F90F7282F32BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH