5eaa8e97cdbe30f4c106f06f5c8af76b93b1539f98ae1a4c5e96b97ef0e27e25

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
Size 646KB
Sample260531-cf75lsaw2k
SHA256 5eaa8e97cdbe30f4c106f06f5c8af76b93b1539f98ae1a4c5e96b97ef0e27e25
MD5 b1eda90b35eb04638cf1698c2618de7d
SHA1 9c18c54276dc179e83678b17a39372a1c6cdfdec
SHA512 efa039cbfdf441f9dd5f046186f781bb1d7a415e6a20ab7bcf6db2132cc470c82de7e57d28cae26d3d89d9930ce91b6cf4c2d153f3a4252613bab763c586f631
SSDEEP 12288:ZBWfqCHQZtvpBabWLwugwhqUzKwv8f97Bd6eJWfezrBTxfwxRFoqnL5HgmdAaNA:DlmShVzKwvS96XGf+fn1HlN
TLSH
T174E4F171B7D200F8E567867BD9425A26E7F3B41607209BEF17A053262F235CC9D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1224	svchost.exe
4604	msdtc.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\phqgoci.dat	svchost.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245a3-9.dat	upx
behavioral1/memory/1224-11-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp	upx
behavioral1/files/0x00090000000244c2-14.dat	upx
behavioral1/memory/4604-16-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp	upx
behavioral1/memory/1224-19-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp	upx
behavioral1/memory/4604-20-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp	upx
behavioral1/memory/1224-65-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp	upx
behavioral1/memory/4604-70-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp	upx
behavioral1/memory/4604-79-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\SA.DAT	svchost.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5072	sc.exe
4168	sc.exe
2412	sc.exe
4628	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4296	cmd.exe
4912	cmd.exe
4928	PING.EXE
3724	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4528	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4928	PING.EXE
3724	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeAuditPrivilege	1224	svchost.exe
Token: SeLockMemoryPrivilege	4604	msdtc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4604	msdtc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2740	2396	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	86
PID 2396 wrote to memory of 2444	2396	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	87
PID 2396 wrote to memory of 4912	2396	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	88
PID 2396 wrote to memory of 4296	2396	2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	89
PID 2740 wrote to memory of 4628	2740	cmd.exe	94
PID 2740 wrote to memory of 2412	2740	cmd.exe	95
PID 2444 wrote to memory of 3100	2444	cmd.exe	96
PID 4296 wrote to memory of 4928	4296	cmd.exe	97
PID 4912 wrote to memory of 3724	4912	cmd.exe	98
PID 3100 wrote to memory of 5072	3100	cmd.exe	100
PID 3100 wrote to memory of 2536	3100	cmd.exe	101
PID 2444 wrote to memory of 4528	2444	cmd.exe	102
PID 4912 wrote to memory of 4168	4912	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop msdtc | sc start msdtc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\sc.exe
    sc stop msdtc
    3⤵
    - Launches sc.exe
    PID:4628
- - C:\Windows\system32\sc.exe
    sc start msdtc
    3⤵
    - Launches sc.exe
    PID:2412
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "for /f "tokens=2 delims=: " %i in ('sc queryex Schedule ^| findstr PID') do taskkill /PID %i /F "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex Schedule | findstr PID
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\system32\sc.exe
      sc queryex Schedule
      4⤵
      Launches sc.exe
      PID:5072
  - - C:\Windows\system32\findstr.exe
      findstr PID
      4⤵
      PID:2536
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 1200 /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 && sc start Schedule
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3724
- - C:\Windows\system32\sc.exe
    sc start Schedule
    3⤵
    - Launches sc.exe
    PID:4168
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 && del C:\Users\Admin\AppData\Local\Temp\2026-05-31_b1eda90b35eb04638cf1698c2618de7d_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WptsExtensions.dll

Path C:\ProgramData\wmDCuh\Java\javapath\WptsExtensions.dll
Size 14.8MB
SHA256 260a6622f11a5eb6e3550dc405e094c49974571522744871f33ebd047e9c00ec
MD5 c9583ad165e46a88941410b441934c28
SHA1 1ccf9c82d563d30a315a3e4b6cccb9430c781b65
SHA512 113a2ffaf5bccfdd1d22a0f06ce81f8a7f20760fc17ee1c74ef2a7fad38cef9d3f72842cbd92e3445f938c89358a28362fe5085c9339fd4aa810cff6ab1c9b12
SSDEEP 393216:98TzC8WfeIRVlFvlQCcv6QaAu5SVDMTNSG/lVrl3KB:9w6lFiPvQ6yhpKB
TLSH
T1BCF633065D9C04ADEE788878CC4D35124E3E16BE6F4DE5B446E960B0FC70AF0EB69B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
TLSH
T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
TLSH
T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
TLSH
T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

SA.DAT

Path C:\Windows\Tasks\SA.DAT
Size 6B
SHA256 12dc5ccd7fecafe070976a1916e9672e3d53085633c86957aee305ccc584184c
MD5 f1a6cd5adaab953a6764ea364e17bfb8
SHA1 c99a1eb2d8974a667d2e0bc2dc1efcbe0ef23387
SHA512 da8cc20e0c0f48a975f97fc133ba4e99de6771163465d03f1cc0e3019fedfe0afa99799b9e343610a941218b19c9117b12e4ab86911d04c2908b6db44523e84c
MD5 SHA1 SHA512

Submit Download

phqgoci.dat

Path C:\Windows\system32\phqgoci.dat
Size 2.7MB
SHA256 8459ff88e9c33eecef718c925366d53ff5eabf6d8b5b934700e42db0550854ad
MD5 570ca8e328754d3b25e5af5b4996a9e3
SHA1 3d6a1f7cbf6a8e7eb7484ded5f71be4f67b488b6
SHA512 8b45ac2d5b7e665d5a111a27633446cef174858b98916ebbe6c88487d71e6792324f44359d59533d7355cb0461650db6516841782754914ebcbd67dafa3e683c
SSDEEP 49152:s6EbSQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL+eUYWHsiJNXvkUKm/V:sjRWGoqZ92yVG/uzGNV9HkAVHL/DKmV
TLSH
T173D533D83E5494D8CD3809B448DB7F33AC0B1912EF4391AC378A914595B3FFAA7A5E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-11-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp

Download

memory/1224-19-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp

Download

memory/1224-65-0x00007FFB27CD0000-0x00007FFB27D2E000-memory.dmp

Download

memory/4604-72-0x0000015677F60000-0x0000015677F80000-memory.dmp

Download

memory/4604-70-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp

Download

memory/4604-73-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

memory/4604-76-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

memory/4604-75-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

memory/4604-74-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

memory/4604-77-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

memory/4604-79-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp

Download

memory/4604-20-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp

Download

memory/4604-16-0x00007FFB25A10000-0x00007FFB25A74000-memory.dmp

Download

memory/4604-104-0x0000015678690000-0x0000015678B4F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads