85b972ed7b07d610813ca82499e82aa27c9267ea0ba59fccf54ac81121ad29c7

General

Target
2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 468KB
Sample260602-3xpbyagw3m
SHA256 85b972ed7b07d610813ca82499e82aa27c9267ea0ba59fccf54ac81121ad29c7
MD5 5de5c684411ba935b662c86f050042ac
SHA1 c081b9584db9d1db3582f902b051f7d6f6e2c785
SHA512 9bb06cd5017376326115e4d7822da883a8d28927f8925ee562dea2da30be941b1daabf133a6880cc3c04f39af393070e8a6081e56b22e98f41d3efe851e8f9c0
SSDEEP 12288:GNGG3U3ITEmUbqLELUdgbqaJ1dRtb8GLH6A2:wAIAmUbqo4dgbF3RZ9aD
TLSH
T1C1A4B015EBA814F9E2B3C17CCD634602EA727C5A0760D7DF13A48A962F276D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3932	SecurityHealthSystray.exe
3308	SecurityHealthSystray.exe
1508	GoogleUpdateCore.exe
3164	DeviceSyncHost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4052	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4052	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3064	schtasks.exe
2288	schtasks.exe
3364	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3320	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	80
PID 3668 wrote to memory of 3064	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	82
PID 3668 wrote to memory of 4772	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	84
PID 3668 wrote to memory of 2288	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 3668 wrote to memory of 2596	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 3668 wrote to memory of 3364	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 3668 wrote to memory of 3932	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3668 wrote to memory of 1712	3668	2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 1712 wrote to memory of 4052	1712	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de5c684411ba935b662c86f050042ac_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240677812.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3064
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4772
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240677968.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2288
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:2596
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240678125.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3364
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240678218.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4052

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:1508

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 517KB
SHA256 413ce74ced853c80e4cc3a39894f3dbe449621f13f8c6f44fcdcb2bfaa6ef06e
MD5 9205253980413fe4336d07869f4dccb2
SHA1 02e58c7f1382a65c7badc02137b95e452ba93f36
SHA512 0e0b56cbe2435227715274045863352e7f7991e2dfb94b3b5cd14cf69bbd256693b54569495b9f25c57faff7289a6056ebd49dfb1fd7c531acd659b96c803477
SSDEEP 12288:iNGG3U3ITEmUbqLELJAgbqaJ1dRtb8GLH6AiwnX:8AIAmUbqo9AgbF3RZ9aoX
TLSH
T120B4BF15EBA814F9E177C17CCD638606EA727C9A0760EBCB13948A961F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 514KB
SHA256 cbfc2082a41824b5eb6f2409cae847162416929515175630834a6312155eba07
MD5 a48715a63237044962d7496089a59055
SHA1 e660672d9a6a84c0076729c02f19a7bce2de03c3
SHA512 9e5ff48ea3feffb2c0ecf3e38e1f459d32e72fc90502641e0183b35e60af0b67ff42c046289bd2d9a1a9bb369baa7c62935bd9b47473236030cebe440fb16b17
SSDEEP 12288:vNGG3U3ITEmUbqLELUGgbqaJ1dRtb8GLH6APt8sy:TAIAmUbqoIGgbF3RZ9adsy
TLSH
T1C4B4C015FBA814F9E2B7C17CCD634606EA727C5A076097CF23948A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240677812.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240677812.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240677968.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240677968.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240678125.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240678125.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240678218.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240678218.bat
Size 250B
SHA256 9d4778ec51fde070daa5fa094af67ad37b0ddec1c9488d59a076d3dd732c3ff4
MD5 767ee9b8e2d195e01a8c7df5d0db68c9
SHA1 47f56bd5cc7aed2489431f1eae4d15ff0b53620e
SHA512 97592b679be84db9df85bd8c9c7986e26c3039255040af4a12e3efdb2d016d393114c68f7b6800288b4be6a5f43fa6939cd9869c9f013eb0c1b7004f4476fae5
TLSH
T128D09553C34FC3B50A16B45341DD558C4054F4880FC537424395F44C5258095B1553C2
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 513KB
SHA256 151223cba5c476bd0f7088ffcb922aef1c27ea488a4aa2e3984a8702ef0cc72f
MD5 bb6458f900fe5594ef574f5274989f1a
SHA1 27ed38b24ccd35edd0ddcc160c042b6b40c6266e
SHA512 b5403ed0bbfc7d38589d530862ec3f8d59c7093259f879ef052564f6d61c4d57f4bf3720d9aa18c2df17e81b69ea9a302966768c36d6173bb2ce42fea5f1ea6b
SSDEEP 12288:5UNGG3U3ITEmUbqLELzngbqaJ1dRtb8GLH6Am9LCrF:4AIAmUbqovngbF3RZ9a3h4
TLSH
T10CB4C015FBA814F9E1B3C17CCD634606EA727C5A0760DBCB23948A962F276D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads