aa163a59fed1ff707ec4b79114db4d834dc83be887fc834039e64d36013941af

General

Target
2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 998KB
Sample260704-1lnvxset3v
SHA256 aa163a59fed1ff707ec4b79114db4d834dc83be887fc834039e64d36013941af
MD5 d44e606058ec908b3c0437ff4aa4427d
SHA1 bc036c9aaaa6bdbd562b9ef64b5214794b876ff2
SHA512 8b2cc373e8d226ef03096730c7c3d2e4eb3a04c733d0015250cbc0ea84d363058a20790e96256a5efb8cc25f6eef3018ba3a0be6312ce3b561d032adf17dab50
SSDEEP 12288:z3gYcPF7ROrgV5c6P1b9ukXx2RV1Jp30pyuCJCotMilaHAW1tIN+309Psy+tVI:bQ7pV5c29uSA5Jp9LjMlH/XzyYq
TLSH
T10D259F1AE3A800FDD437C274CD665607EBB2B41623309ACBA7D59E562F23A716E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3204	cmd.exe
3804	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Video\0	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
3684	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3204	3684	2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 3204 wrote to memory of 6072	3204	cmd.exe	90
PID 3204 wrote to memory of 3804	3204	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001 >nul & netsh wlan show profiles 2>nul
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6072
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 1KB
SHA256 8656ac01e090537b4dd458bd43716d2d90e101cab69aef3e2b3b6116e980b4da
MD5 836289baf6d68dd13e657abda6d8fe0c
SHA1 93b457d58e9fd80fa985bfe2c3de572fad0e373e
SHA512 2a29aaeb97a2fc07cae7b693d60168ac2376e905bdd63b0ca507f794e6107ae50ce849a6960a33a621eb730e12a392ccf9d277ff466fdf6344f53394807a208e
TLSH
T1E2318AD1889A827BEA974C18FC552D904611336D07D6096ACB71E3CABB22ED94E320B7
MD5 SHA1 SHA512 TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 1KB
SHA256 9f3cbccfeeadd79984adde123e9d6320fd418ccb2cf21a8e377bb06daa013ca4
MD5 8b7ffd37fe73797b37fe477a2c4320b6
SHA1 de907a0b99a479438e563543b0fd8d23e09c137b
SHA512 a4afe573df1261598b5f3081b1745e93557b671980d33f41fd0eb28d6fa38753d4313429c13707917c05ecd47a4a64c17a0d8661eb4c95797f50ced7e0d8a109
TLSH
T1E03177D1889A927BEA974C18E8552D904610336D07D6096ACF71E3CABB26ED84E320B7
MD5 SHA1 SHA512 TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 2KB
SHA256 cc79ecf3443f6f5c3cd38e6b7c8e7a8a69e36e99cf0a47c7553e570e78d92876
MD5 ed84612f93497beed615dc3e839f3a33
SHA1 cd5ea70adc628a31c06116dea3676f635bf1c0c5
SHA512 640351139f7ff1be330d5e99401104d4fb0a8788fae8868bfa96760290c4cf40fa3491a94917b0af13a376f3c1e11e762d2c4711027db79790fa36bfb8bd337b
TLSH
T1E641BDE18895C67BBB971C14E8552F809509239907C60CA9CFB0B3C5BA31ADD8E3307B
MD5 SHA1 SHA512 TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 2KB
SHA256 b42fcde86f7423ec715aa133fd113c4bf2478f3a64d52a779c514a953d09d047
MD5 17b7963f036f9ba04e6735944a0c878a
SHA1 abdfbc8919636ee378f2720e7f3ff251a07c64e3
SHA512 80ab556391eecd1b1856af126cc147ee8815d37ca221cf949ecf9f0350075bcca936e3b6294ca5bac9966e7ebb62aea58f94efc5d2b9d00452d0dd4d3965f27d
TLSH
T16451BDE18895C67BBBD71C14E8552F80954923A90B860CA9CFB0B3C57A31A9D8F3307B
MD5 SHA1 SHA512 TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 2KB
SHA256 62fa19ab7d537b60e59e5f14a1172105a3ad2d2a5199f4bc7bf382c6f62153a6
MD5 e5a50f81253528f624a86246cd2ec1cd
SHA1 0dc0c9b29faf4cd7abcfe08d99050b0f9f4ce50e
SHA512 453ea507bb2496e67e27c71f5b5d9836c2f4f34191a5bf49ff015ee75d918a5e1c6bb71dde6751550cdd25a8e03a50f85c87471fd40276e70eb81b9f22226782
TLSH
T11351CAF18495C63BBB932C04D8152EC19548239A5B960DE9CFB0B3C5BA3199D8F3347B
MD5 SHA1 SHA512 TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 5KB
SHA256 785513656c52fdbefa7ccffd33a908c75042ebcf30cff02b5d9e19caabc9bc2a
MD5 39eaa0e91708f1c458010a0b934ed6ec
SHA1 afc37e6b103d3e038b59e1a0c9e9768308158035
SHA512 849bde0d04a444edd8b0cca365ece25beb411ba1e604c12eaed8166803684b09e125f531aaa6ac42497665f0ea01a009edc4cc69f333f6b8dcb7b3655d793ad7
SSDEEP 96:ofyRaUCbWETPm/PzBFHcP0ERemwzxicqvGcCbcPcucEFUwz/Uemtm11z4QEL7rnA:UyRahkzBFHQNMHFi8jKZTFUwYn4109X0
TLSH
T159B10DB184C5C63F77625C11E5A5BED490680BC10B962F94CF78A3C8B730A5D9E724BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spctor_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\spctor_dbg.txt
Size 814B
SHA256 8b8e12589f52d9157bb51658a8d0121a65cc87b3cbbc39c7dad779e3b3024265
MD5 af846da5735b1c6bd0fd46a476333954
SHA1 f9777672f9bb7e8abe115e7c8d67b53cf9ef2d34
SHA512 f971e1493e5fd219e600af580de40ab220fb1f5adbf6286f35449f9af81cb385cb759a9d28304eecc00b85c1c74daa411894a872c6915556c4423d6e6062d5ae
TLSH
T1F70102C08CA3A357D0035D6DFCB53A946B22711D06E942076F21E3CAFE28EA1CE22142
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads