Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe
- Size 142KB
- Sample260707-jymd7aav6q
- SHA256 15f7c32bfb13550a8e96f71ee698e00788dd97276a59f376b94a5fee8785157f
- MD5 5902dcac8384c1379c9961a95f4bb4ea
- SHA1 bbf148459dbd8fc7b1ce5f162f0722ec610367a7
- SHA512 b2940eb87c8e42182b0fe313ea47786e6e0f78abf0bdb2c294eba9ecfab0b32d217bcf13fbadfb95091dceaae276ec4e08c693331067244e121a40f20762a5d6
- SSDEEP 3072:uiRlOc6jbB0bMOeAywa0+PvWStYFLOaGstZiV8FowTK:j4jt0AAvAXtYFLjT3Ft2
- TLSH T142E35B57B3A531FAE1738239C9A20642E776783607205BEF03A043752F276D1DE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.exe 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe -
pid Process 3284 powershell.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 3284 powershell.exe 3284 powershell.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3284 powershell.exe Token: SeIncreaseQuotaPrivilege 3284 powershell.exe Token: SeSecurityPrivilege 3284 powershell.exe Token: SeTakeOwnershipPrivilege 3284 powershell.exe Token: SeLoadDriverPrivilege 3284 powershell.exe Token: SeSystemProfilePrivilege 3284 powershell.exe Token: SeSystemtimePrivilege 3284 powershell.exe Token: SeProfSingleProcessPrivilege 3284 powershell.exe Token: SeIncBasePriorityPrivilege 3284 powershell.exe Token: SeCreatePagefilePrivilege 3284 powershell.exe Token: SeBackupPrivilege 3284 powershell.exe Token: SeRestorePrivilege 3284 powershell.exe Token: SeShutdownPrivilege 3284 powershell.exe Token: SeDebugPrivilege 3284 powershell.exe Token: SeSystemEnvironmentPrivilege 3284 powershell.exe Token: SeRemoteShutdownPrivilege 3284 powershell.exe Token: SeUndockPrivilege 3284 powershell.exe Token: SeManageVolumePrivilege 3284 powershell.exe Token: 33 3284 powershell.exe Token: 34 3284 powershell.exe Token: 35 3284 powershell.exe Token: 36 3284 powershell.exe Token: SeIncreaseQuotaPrivilege 3284 powershell.exe Token: SeSecurityPrivilege 3284 powershell.exe Token: SeTakeOwnershipPrivilege 3284 powershell.exe Token: SeLoadDriverPrivilege 3284 powershell.exe Token: SeSystemProfilePrivilege 3284 powershell.exe Token: SeSystemtimePrivilege 3284 powershell.exe Token: SeProfSingleProcessPrivilege 3284 powershell.exe Token: SeIncBasePriorityPrivilege 3284 powershell.exe Token: SeCreatePagefilePrivilege 3284 powershell.exe Token: SeBackupPrivilege 3284 powershell.exe Token: SeRestorePrivilege 3284 powershell.exe Token: SeShutdownPrivilege 3284 powershell.exe Token: SeDebugPrivilege 3284 powershell.exe Token: SeSystemEnvironmentPrivilege 3284 powershell.exe Token: SeRemoteShutdownPrivilege 3284 powershell.exe Token: SeUndockPrivilege 3284 powershell.exe Token: SeManageVolumePrivilege 3284 powershell.exe Token: 33 3284 powershell.exe Token: 34 3284 powershell.exe Token: 35 3284 powershell.exe Token: 36 3284 powershell.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3412 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 87 PID 4996 wrote to memory of 6028 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 89 PID 4996 wrote to memory of 2140 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 91 PID 4996 wrote to memory of 5112 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 93 PID 4996 wrote to memory of 3060 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4996 wrote to memory of 5900 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 97 PID 4996 wrote to memory of 3284 4996 2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_5902dcac8384c1379c9961a95f4bb4ea_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "EdgeUpdateTask" /f2⤵PID:3412
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineUA" /f2⤵PID:6028
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "AdobeFlashPlayerUpdate" /f2⤵PID:2140
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "GoogleUpdateTaskMachineUA" /f2⤵PID:5112
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "IntelCpUpdate" /f2⤵PID:3060
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "MozillaTaskUpdate" /f2⤵PID:5900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Remove-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ag' -Force;Remove-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284
-