Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11-20260513-en
1 signatures
150 seconds
General
- Target 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 732KB
- Sample260531-ml5lsaey2y
- SHA256 2c708536bd5d6501dd193fbff271e6b164ff75b9a6af50fb6fc224eaf64d4d6d
- MD5 f6272fe9b55c3e878483faac0ec07b64
- SHA1 9b9d22bb57fdf028216d918f6aa6a062fd3f835d
- SHA512 aa7d419c22efe87243ea4ce49f43e48772ef3a00f4d3f12128ac96b14807e910112f98311f3a82c2dd657c5deddcd74e6f9245f3ab1e87f5ddfec9f4a39ef3e5
- SSDEEP 12288:uqTvMOoTcpIDc7Qi4LcJ7Zg2ofv6jcEISBDaYisdEdDdyd1nOoYaD+i:x7MOowpocl4o75uvacEl9imnOU+i
- TLSH T138F4AE51F6F900F8D03B9139C996A61BFAB2380907205ADB13E406A92F777E45F7B712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe 852 2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_f6272fe9b55c3e878483faac0ec07b64_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:852