Overview

overview

8

Static

static

3

2026-06-28...lc.exe

windows10-2004-x64

8

2026-06-28...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/06/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 1.6MB
  • Sample260628-xt97cab18x
  • SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to get system information as a root user.

    execution
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Checks processor information in registry
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/wmi -ClassName WmiMonitorID | ForEach-Object { $name = [System.Text.Encoding]::ASCII.GetString($_.UserFriendlyName).Trim([char]0); $pc = [System.Text.Encoding]::ASCII.GetString($_.ProductCodeID).Trim([char]0); $sn = [System.Text.Encoding]::ASCII.GetString($_.SerialNumberID).Trim([char]0); '{0}|{1}|{2}' -f $name, $pc, $sn }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetAdapter -Filter 'HardwareInterface=TRUE' | ForEach-Object { $mac = if ($_.MacAddress) { $_.MacAddress } else { $_.PermanentAddress }; '{0}|{1}' -f $_.Name, $mac }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4632

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 89cbfd7b671e37ff94426145203383fe656e57f4605ba0365ac70c87dec116cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_sthqywvx.hcm.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sthqywvx.hcm.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3848-9-0x000001EC4F030000-0x000001EC4F040000-memory.dmp
        Download

        memory/3848-8-0x000001EC4F030000-0x000001EC4F040000-memory.dmp
        Download

        memory/3848-17-0x000001EC4F040000-0x000001EC4F062000-memory.dmp
        Download

        memory/3848-18-0x000001EC68A30000-0x000001EC68A5A000-memory.dmp
        Download

        memory/3848-19-0x000001EC68A30000-0x000001EC68A54000-memory.dmp
        Download

        memory/3848-21-0x000001EC4F030000-0x000001EC4F040000-memory.dmp
        Download

        memory/3848-20-0x000001EC4F030000-0x000001EC4F040000-memory.dmp
        Download

        memory/3848-22-0x000001EC4F030000-0x000001EC4F040000-memory.dmp
        Download