Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 19:09
General
- Target 2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 1.6MB
- Sample260628-xt97cab18x
- SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information as a root user.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/wmi -ClassName WmiMonitorID | ForEach-Object { $name = [System.Text.Encoding]::ASCII.GetString($_.UserFriendlyName).Trim([char]0); $pc = [System.Text.Encoding]::ASCII.GetString($_.ProductCodeID).Trim([char]0); $sn = [System.Text.Encoding]::ASCII.GetString($_.SerialNumberID).Trim([char]0); '{0}|{1}|{2}' -f $name, $pc, $sn }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetAdapter -Filter 'HardwareInterface=TRUE' | ForEach-Object { $mac = if ($_.MacAddress) { $_.MacAddress } else { $_.PermanentAddress }; '{0}|{1}' -f $_.Name, $mac }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4o5tmxdm.cvx.ps1
memory/2328-23-0x0000018BB8F50000-0x0000018BB8F7A000-memory.dmp
memory/2328-26-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-15-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-16-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-17-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-21-0x0000018BB8D00000-0x0000018BB8DB2000-memory.dmp
memory/2328-20-0x0000018BB8CE0000-0x0000018BB8CFE000-memory.dmp
memory/2328-22-0x0000018BB8DC0000-0x0000018BB8DCA000-memory.dmp
memory/2328-24-0x0000018BB8F50000-0x0000018BB8F74000-memory.dmp
memory/2328-8-0x00007FFBD6CAF000-0x00007FFBD6CB0000-memory.dmp
memory/2328-25-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-14-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-27-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-28-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-30-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-31-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-32-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-34-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-13-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-12-0x00007FFBD6B20000-0x00007FFBD74C4000-memory.dmp
memory/2328-11-0x0000018BB8A10000-0x0000018BB8A32000-memory.dmp