5ff90e8b7b121ff5844759933cacfa6e3e1bed1af8e5488f08f56e45c78ba02a

General

Target
2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 534KB
Sample260604-gdz4fabs8k
SHA256 5ff90e8b7b121ff5844759933cacfa6e3e1bed1af8e5488f08f56e45c78ba02a
MD5 3d30f22e64586574d38f8f15c04c8cca
SHA1 d3775b27fc77da91f0c341074cf747228d1306eb
SHA512 99228aea02becb5652d3813122cf95c4eb3fe20f627b428c312cf277f0558dbdc565054f5a56f6c0a4c29569809a694ec6e54d1d92216072e02dcf2029a949b6
SSDEEP 6144:kl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfz6FeglM2BgaCSWNIcroeXyTk2o4yvVr:INGG3U3ITEmUbqLELm9uIcLC7Pyd4M
TLSH
T11FC4CF15FAA814F9E177C17CCD634606EB727C5A0760ABCF23948A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1800	SecurityHealthSystray.exe
640	GoogleUpdateCore.exe
932	DeviceSyncHost.exe
4140	SecurityHealthSystray.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4648	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4648	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
904	schtasks.exe
1244	schtasks.exe
4236	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 228	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 1112 wrote to memory of 904	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 1112 wrote to memory of 2672	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 1112 wrote to memory of 1244	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 1112 wrote to memory of 5016	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 1112 wrote to memory of 4236	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 1112 wrote to memory of 1800	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 1112 wrote to memory of 3168	1112	2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 3168 wrote to memory of 4648	3168	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_3d30f22e64586574d38f8f15c04c8cca_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:228
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240672000.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:904
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:2672
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240672203.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1244
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:5016
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240672437.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4236
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240672562.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4648

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:640

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 543KB
SHA256 21da95301ab06878301637ac07d24573fbdbb388faba87344c5d6cffcf4c7588
MD5 45be846c8a2d95b5145eb9380881ee47
SHA1 9f68e8b45e43eb92486ede855ae6806fc6910da2
SHA512 e2796841524029a0e2f31bec59b44d15a8ade2b532554d92825da6478040f2441129c293b4212b7f821334b21c60f072bf6ac2aceeba0290c797c92bfd5695c8
SSDEEP 6144:zl3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzLFegRM2QwaCSWNIcroeXyTk2o4yvV7:5NGG3U3ITEmUbqLELOtuIcLC7Pyd4A
TLSH
T1C0C4C015FAA814F9E177C17CCD634606EB727C9A0760ABCF13948A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 567KB
SHA256 9f5f358b4f5d01f3fb50ff6d3dc1f4bbdb540d374004ce1eaf2fad771312eda8
MD5 d4ccadb74a419cba8996e74d4f9f82cb
SHA1 7136369ccfaec04dc01f92b06de7ee13f6d992da
SHA512 b5897b01838ee53c2de16673633cdac04c3f67e1a10df590a3f573f4ff8eb75dd90a0a5a6bbe4e96a764829f3e5a1b5c6f2f92233014a5c79b6a5c2330b83a54
SSDEEP 12288:xNGG3U3ITEmUbqLELbduIcLC7Pyd4n/Zl:xAIAmUbqonduI8aPyd4nr
TLSH
T193C4CF15FAA814F9E177817CCD634606EB727C5A0770ABCF13A48A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240672000.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240672000.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240672203.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240672203.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240672437.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240672437.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240672562.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240672562.bat
Size 250B
SHA256 ff68e6556377d1935c77f6843d317f7573d643dc1b1d691da46ddc6c2d5050df
MD5 fb029254ee087707fa529bcd427a1cba
SHA1 d753863044ba8a6945239eb1cda8469af235ccce
SHA512 35ab097cb459376e4220a372c89bf75e1b2cfe554a9fc74b46bca6de23f0e68536d1fb45655aa8d0d08dd98a4faa2b4090224ff9fdd5cd44fdc818722f8b3e82
TLSH
T145D09513934FC7E4010164C244DD151C8051E40C1F403742836C9D182558018F5553C2
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 561KB
SHA256 fd5cc14e8d42d0a114873fa021b3f07631992d494e0b319aa4f282853ce6f8d4
MD5 f832c1e0af6fa90125cb2b00de11fdb2
SHA1 fcc404f04f047e72355d336398d05e2571257906
SHA512 4c59217f8b4ef0b18dcdcefc576493dd4fb608dbfd8ee285eae34542e74a277bd9bdc38171d06acdf3336d70656397c22257b65904021166fbfaff1066029f64
SSDEEP 6144:el3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfz4FegkM2K+aCSWNIcroeXyTk2o4yvVY:qNGG3U3ITEmUbqLELEfuIcLC7Pyd49n
TLSH
T17FC4C015FAA814F9E177C17CCD634606EB727C9A0760ABCF13948A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads