930fe68616fdaa3884f398ee2622cc1675ef3ba0da3e38034c444b6d4386d1e2

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 3.3MB
Sample260529-cnn2psbs2w
SHA256 930fe68616fdaa3884f398ee2622cc1675ef3ba0da3e38034c444b6d4386d1e2
MD5 ca5e4d65e16aadd010efd7ea73ccb1c4
SHA1 4bfc2b069f2187a6e66ba93b29e0d8d83ed01c1b
SHA512 b4f5940c21488ee79a118e34e25929bb8094cf7306a9b660c3729ceac5b53d052bec34ae287c250c9684441df9240d2a386bb4564ed60df6fe7395a748dc8f9e
SSDEEP 98304:KLaniiBrGh0qEwQfPkmMp3++uLhfzhWnvHYY:KLkLrGCy3DkhLQnvHY
TLSH
T120F51201B19901FBE02BC17DC7128D06EB71F86E0734A6D75391EEA65F17AD8AE36B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3908	5092	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	84
PID 3908 wrote to memory of 2480	3908	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	86
PID 2480 wrote to memory of 2432	2480	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2432 wrote to memory of 1040	2432	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 1040 wrote to memory of 4512	1040	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 4512 wrote to memory of 1160	4512	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 1160 wrote to memory of 2600	1160	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	96
PID 2600 wrote to memory of 3744	2600	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	98
PID 3744 wrote to memory of 772	3744	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	100
PID 772 wrote to memory of 1604	772	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	102
PID 1604 wrote to memory of 3024	1604	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	104
PID 3024 wrote to memory of 2728	3024	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	106
PID 2728 wrote to memory of 5436	2728	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	108
PID 5436 wrote to memory of 5600	5436	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	110
PID 5600 wrote to memory of 5612	5600	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	112
PID 5612 wrote to memory of 5696	5612	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	114
PID 5696 wrote to memory of 5796	5696	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 5796 wrote to memory of 5736	5796	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	118
PID 5736 wrote to memory of 852	5736	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	120
PID 852 wrote to memory of 5420	852	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	122
PID 5420 wrote to memory of 8	5420	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	124
PID 8 wrote to memory of 6120	8	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	126
PID 6120 wrote to memory of 5144	6120	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	128
PID 5144 wrote to memory of 5404	5144	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	130
PID 5404 wrote to memory of 476	5404	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	132
PID 476 wrote to memory of 1288	476	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	134
PID 1288 wrote to memory of 2776	1288	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	136
PID 2776 wrote to memory of 2128	2776	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	138
PID 2128 wrote to memory of 716	2128	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	140
PID 716 wrote to memory of 2848	716	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	142
PID 2848 wrote to memory of 6108	2848	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	144
PID 6108 wrote to memory of 1004	6108	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	146
PID 1004 wrote to memory of 4252	1004	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	148
PID 4252 wrote to memory of 4468	4252	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	150
PID 4468 wrote to memory of 3976	4468	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	152
PID 3976 wrote to memory of 72	3976	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	154
PID 72 wrote to memory of 3256	72	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	156
PID 3256 wrote to memory of 5188	3256	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	158
PID 5188 wrote to memory of 5720	5188	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	160
PID 5720 wrote to memory of 1652	5720	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	162
PID 1652 wrote to memory of 5432	1652	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	164
PID 5432 wrote to memory of 5152	5432	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	166
PID 5152 wrote to memory of 6020	5152	2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        33⤵
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        35⤵
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        37⤵
        Suspicious use of WriteProcessMemory
        
        PID:72
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        39⤵
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        41⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        43⤵
        Suspicious use of WriteProcessMemory
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-05-29_ca5e4d65e16aadd010efd7ea73ccb1c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe --eh-admin-ready --deploy C:\Users\Admin\AppData\Local\Temp\boop.txt
        44⤵
        
        PID:6020

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads