b91288e475e9e3bcb3b7913297170cf1162400b5666f0c0ddf4796eacd3d3835

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 202KB
Sample260604-vb7mdsbx5q
SHA256 b91288e475e9e3bcb3b7913297170cf1162400b5666f0c0ddf4796eacd3d3835
MD5 8bedd3ed1a796850aa316cc6cf3938c0
SHA1 e5a964cf5b6e61e570cef3c8f92d9e524e63df19
SHA512 f282161cfca4f22cea9e82239330036fa1699b90e454ee5d41445761cb84d324c9e084df84970bd60643d2030473475bf915c8de4c69761dfb641f25e7d654e1
SSDEEP 3072:qk20TONdUxCohInwUIw+LMeDFrDZG95sLvYHrTN+x1AyFY4ZOTf2siD:qk20vxCAInF+LMwFr65YmfN/fliD
TLSH
T1DC145B55B3E800F9E5B39179CDA14946E7B378160731DADF03A042BA9F236D1AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2196	taskkill.exe
4404	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4984	5604	2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	81
PID 4984 wrote to memory of 2196	4984	cmd.exe	83
PID 5604 wrote to memory of 5108	5604	2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	85
PID 5108 wrote to memory of 4404	5108	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_8bedd3ed1a796850aa316cc6cf3938c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\System32\cmd.exe
  /c taskkill /F /IM vgtray.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vgtray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\Windows\System32\cmd.exe
  /c taskkill /F /IM vgc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vgc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads