602f0197659b1a71cc38d1faab1c1250203a6d2a7226ae7fdd2c0d0bd6885cc6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe
Size 80.0MB
Sample260601-cddszsdx9q
SHA256 602f0197659b1a71cc38d1faab1c1250203a6d2a7226ae7fdd2c0d0bd6885cc6
MD5 c6d80553832ef7d2d31ee21fa64c22ec
SHA1 546bba9e58bc82eef5ba2a4edb4093d7750fab5c
SHA512 b9224b80cdcfe211d58d4814a7ecf101b3dc63cfa6f84ad46f3eff8b159cfc1fbabca41ea9a202ed036e2e65160fac10b57b9b7dbad524d1ee293371031cd195
SSDEEP 49152:Gb4Nq6cWMYi2wQ71v52grqwl3IzUDnjVf8kTLK2FslB:Gb4NRcWh71v52O4inBtLiB
TLSH
T12908E116A3E840F8D077D174CA568607DBB2F8461734D6DF53D08A9A2F23BB25A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4192	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	powershell.exe
4192	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4004	5132	2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe	80
PID 5132 wrote to memory of 4004	5132	2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe	80
PID 5132 wrote to memory of 3412	5132	2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe	83
PID 5132 wrote to memory of 3412	5132	2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe	83
PID 5132 wrote to memory of 4192	5132	2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c6d80553832ef7d2d31ee21fa64c22ec_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ChromeData\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\ChromeData.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeData.zip

Path C:\Users\Admin\AppData\Local\Temp\ChromeData.zip
Size 470KB
SHA256 8e5b032e667b40e8cadc6da5b4949c296dc5dbc1695b338f7c3f9ad958ab324f
MD5 bc9295a4afd5770861781562b817dbf8
SHA1 1f6e6995b8dae8451743683a4683808c2d4392a2
SHA512 c77196c43dcff5d75173817404917cd8a9547175cc6c1565dadcdba17c9befc388d32922dbc56c8a6008f081a38ecbd2e199d3ff94d5d55aad95c00a51201e9f
SSDEEP 12288:9MQCOzTgs0bLzVRRFkY+MbPjeP25b8B+YM4cF/e7:+QCOfyPzVRR7PiP2l8oY3cF/K
TLSH
T13AA423CE51278A2FECA94733C95F4EE91F84F87FE0B1291905B574D2811C8F0897A61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

add_chrome.json

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\Chrome\Default\add_chrome.json
Size 472B
SHA256 4282c52f48907990a471a284b5eb84e506a267e0580a1b91c504c159bf4dff77
MD5 0cfa1a517d6d409e6376a51a01b2a007
SHA1 29bd0b523be7e20dec2789991a3e508943dd459f
SHA512 0875cd367f851246acc037a84b833a2b36a9d3f3fd8aa020240a35949f8ce9dea4f5b4034f59290e7498473776273aa6c181b32966ccb83f7d033bd414806b77
TLSH
T100F05C56D4511CBB8CB0116E90368287F755431FA5144E07F4F9668C7F7283A7785CD0
MD5 SHA1 SHA512 TLSH

Submit Download

add_firefox.txt

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\Chrome\Default\add_firefox.txt
Size 284B
SHA256 d68dd29d8f61b5c8c0f41b4d8822b8158a833b2f4c699b130f324f1e10b7a250
MD5 67ce2fe77f0a1542bd1ec3f8e61230de
SHA1 916eb30cb844ed063cf83ad1cc49889e16dbbba1
SHA512 adb5535e316781bf93d8e0b2375c7be07e4d5410618b97e33e84b92d03f5f68918e9f1fad1ca4d74d4d060d2d0344f1a4e6cee632068f3f0309c24f28b3405fd
TLSH
T1BCD0EB8EB88334E1CC8194542523866B5D5A0A489B7EBA01604B77313E0B961A6D849A
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\Chrome\Default\cookies.json
Size 338B
SHA256 f39ed3f7a2ded21e8a53fea2e6367fb3afb82dffa45d5396a1c16a4e85e968a0
MD5 b4145717d650a288d9c429b83c4158bf
SHA1 f53403941f33fd38bda4c281e72627a366c2a46a
SHA512 b0d0dbefda3af1e760c29cb2261981cbcca8d743aa2b435f0f8348cb94189b6b430b29c1c86e8f34bb3ad8ab1d79f85a2dfa241c182c4c064b8094f5a9ed22cc
TLSH
T1C2E0284DD4C12872CC5295640C230F9E7E791711C97CFD03A84D96107D0351531548C7
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\Chrome\fingerprint.json
Size 970B
SHA256 58cfd9898d1b615112ecd1022ff9c7601a32d92c472dc9e0e69b65bfc2f8d03f
MD5 c34c71307ddbd46999769214490a36db
SHA1 6530cd605dde2478f2aefeab1462cb2f486ed437
SHA512 774d02b6b845b908f2617f7be01f1556b02cd772eb5382164c66e586c27920c3f7ba578ab349cb926af81fd56c97b204bde086968ab3c8f1294a067a98b35c1d
TLSH
T10311D942A956D4BF2931F058D274A9573A718F2D31B90C2732FB641C191A73E325AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\screenshot.bmp
Size 5.9MB
SHA256 22a32f3f0aeda2ca11b0e93138fc222a013d0c2b91cf74e92c9b3e2e4092980f
MD5 261798f6f9c4b5378fdc2c9f5932d53f
SHA1 f0b0af9a36d0ad04561e3e7efc45ea253ccc88d4
SHA512 fff638ceccd401c49a855787323f4249bbec7ba7a3dabf45017e95fd302d8dcb1de85b7d1981bfd4bd9658ccce0289a6bb9061050836216dbc34e6af92c6370b
SSDEEP 12288:iW5u04LV1l9F7vSnzY7c7IjjMe9AY3qyQ:iW5u047fFWvt2qP
TLSH
T13A56E123B5AA7D74EA2A397582F4071DA324ECD8B748074E8529F8F0F1923456DF76B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

summary.txt

Path C:\Users\Admin\AppData\Local\Temp\ChromeData\summary.txt
Size 500B
SHA256 685302c054476b26b459fbad5873bc46ced7b9dd8f4fc74dbef94293d19897c4
MD5 51b3f302d479fc739cc7a3de5349addb
SHA1 bc8b0f54c44d396978f4d90b6c1e665aeadbd11f
SHA512 8bbc375d09ddd68871cd8ed0d0a1fab0babfa146a0120b0740285bda0c0f13740bd9ecd1a87edbcaee02ecf65cce47c6bb6d0318196515dcde3244075d2c4d33
TLSH
T15CF026BC86197625B50E333C6858E6D0E9F37C67D18503233AD9D1E72D2E05D5CA98CB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1iz3adrj.t0q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1iz3adrj.t0q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4192-25-0x0000029B25250000-0x0000029B25262000-memory.dmp

Download

memory/4192-26-0x0000029B25040000-0x0000029B2504A000-memory.dmp

Download

memory/4192-24-0x0000029B25040000-0x0000029B2504A000-memory.dmp

Download

memory/4192-23-0x0000029B25270000-0x0000029B25323000-memory.dmp

Download

memory/4192-22-0x0000029B25250000-0x0000029B2526C000-memory.dmp

Download

memory/4192-14-0x0000029B24FC0000-0x0000029B24FE2000-memory.dmp

Download

memory/4192-7-0x0000029B09CB0000-0x0000029B09CC0000-memory.dmp

Download

memory/4192-8-0x0000029B09CB0000-0x0000029B09CC0000-memory.dmp

Download