03eab1406d7d4d4505971c4e3b73b6cd81bedbd95a109869fd955510781d26c7

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 8.4MB
Sample260703-pm82psd14j
SHA256 03eab1406d7d4d4505971c4e3b73b6cd81bedbd95a109869fd955510781d26c7
MD5 8a37981d3d0d3118374a8f2917f74792
SHA1 ffed95cf4cb4a0f8cda964e1abaf05aff2d695c6
SHA512 ad942c1546ee4093ead9b9d63205a158aa046a376b10b11611c4f6b812f6078a3118836709425d40601aa8156e24910c6fc0805fddfed859c06e239bce3dcd61
SSDEEP 98304:Af9Gzj+72yN/3O3rI7jxXyzP792k6SQsP1g:8Tqw/QKj9yzP7Qy1
TLSH
T1AF969E866B14CDD2F94040B1B8D14D1C7BA34B26CA95C4F6A0A189C19EE19FB7EBF17C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 5944	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 1436 wrote to memory of 5696	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1436 wrote to memory of 3796	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 1436 wrote to memory of 3772	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 1436 wrote to memory of 5820	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 1436 wrote to memory of 5484	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 1436 wrote to memory of 4632	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 1436 wrote to memory of 5472	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 1436 wrote to memory of 4588	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 1436 wrote to memory of 1496	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 1436 wrote to memory of 5220	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 1436 wrote to memory of 2296	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 1436 wrote to memory of 3752	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 1436 wrote to memory of 3420	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	102
PID 1436 wrote to memory of 1404	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 1436 wrote to memory of 1920	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 1436 wrote to memory of 3668	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 1436 wrote to memory of 1480	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 1436 wrote to memory of 5320	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 1436 wrote to memory of 6088	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 1436 wrote to memory of 5068	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 1436 wrote to memory of 2340	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	110
PID 1436 wrote to memory of 4468	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	111
PID 1436 wrote to memory of 4836	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	112
PID 1436 wrote to memory of 4828	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 1436 wrote to memory of 4008	1436	2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads