42308fc634a67cef017d22b873e74de0183e8d20df1821ef8dc0e98bf967f335 | Triage™

Login
Reports

Overview

overview

Static

static

2026-06-26...lc.exe

windows10-2004-x64

2026-06-26...lc.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc
Size 170KB
Sample260629-vgajvaby6n
SHA256 42308fc634a67cef017d22b873e74de0183e8d20df1821ef8dc0e98bf967f335
MD5 36641b980d994d2bcc4267016e4cc562
SHA1 d164418ca8d75e0e4bff62916db89a651e649d27
SHA512 e9dfc585ae5e7ac84c93d93ce96f36ac9abd42836e4928da3a9e5703c6a6f98d73ca95972f21ebeedc7967c928abc1ed45542129b9dc7ce68007f6a43460abf6
SSDEEP 3072:5tG1K/SK31L0Bb0+Ty/XTR2BMLFrcfRYW1xOo:5c1KEF0+oj5WjF
TLSH
T1F2044C07A6AA70FAE2378534C5924A01FB3378714BA1EADF47504AB61E236D4DF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence ransomware trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

13 signatures

150 seconds

defense_evasion persistence ransomware trojan

Behavioral task

behavioral2

Sample

2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc.exe

Resource

win11ltsc2024-20260629-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

defense_evasion persistence ransomware trojan

Malware Config

Targets

- Target
  2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc
- Size 170KB
- SHA256 42308fc634a67cef017d22b873e74de0183e8d20df1821ef8dc0e98bf967f335
- MD5 36641b980d994d2bcc4267016e4cc562
- SHA1 d164418ca8d75e0e4bff62916db89a651e649d27
- SHA512 e9dfc585ae5e7ac84c93d93ce96f36ac9abd42836e4928da3a9e5703c6a6f98d73ca95972f21ebeedc7967c928abc1ed45542129b9dc7ce68007f6a43460abf6
- SSDEEP 3072:5tG1K/SK31L0Bb0+Ty/XTR2BMLFrcfRYW1xOo:5c1KEF0+oj5WjF
- TLSH
  T1F2044C07A6AA70FAE2378534C5924A01FB3378714BA1EADF47504AB61E236D4DF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence ransomware trojan
- UAC bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Drops startup file
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

defense_evasionpersistenceransomwaretrojan

behavioral2

defense_evasionpersistenceransomwaretrojan

© 2018-2026

Terms | Privacy