81d809a676469d691bcebd41a3e0543eeb073c046d769f3a3a7004c721ae8cc7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_8c8696a88a15cc82a49bd12cd4a25321_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 29.5MB
Sample260528-daerjsfy7w
SHA256 81d809a676469d691bcebd41a3e0543eeb073c046d769f3a3a7004c721ae8cc7
MD5 8c8696a88a15cc82a49bd12cd4a25321
SHA1 a08aa4441d5a218867d3545a48dbf898d9249e55
SHA512 4f601936a57f384d83b51938dd08ab7403c949e4685bf324cd00d3ffe5b9d19a4cc00aaf424ca4c77ffe31cd2d919582e1cf2f527832e8f5674b3b0fdd6e78de
SSDEEP 393216:Ap0Xw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:5WO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1AA671252BBE850B8F0B39230BA75552ED6777C210B3096CF2391B51D1B729D09A7EB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1412	2404	2026-05-28_8c8696a88a15cc82a49bd12cd4a25321_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_stealc.exe	82
PID 1412 wrote to memory of 3804	1412	cmd.exe	84
PID 2404 wrote to memory of 5044	2404	2026-05-28_8c8696a88a15cc82a49bd12cd4a25321_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_stealc.exe	85
PID 5044 wrote to memory of 2684	5044	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-28_8c8696a88a15cc82a49bd12cd4a25321_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_8c8696a88a15cc82a49bd12cd4a25321_cobalt-strike_darkgate_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh mbn show registration
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\netsh.exe
    netsh mbn show registration
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh mbn show readyinfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\netsh.exe
    netsh mbn show readyinfo
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads