Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 20:00
General
- Target 2026-07-10_85ba3967932685238df17fb5260d4acc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 1.9MB
- Sample260710-yre4vsax9s
- SHA256 fdaf154269fa138235827f9350dd6309f0a618271fa67aaed8862740f1c8e8cc
Malware Config
Signatures
- Detects executables packed with Enigma 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_85ba3967932685238df17fb5260d4acc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_85ba3967932685238df17fb5260d4acc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3888-19-0x000001AD4F870000-0x000001AD4F922000-memory.dmp
memory/3888-21-0x000001AD4F630000-0x000001AD4F63A000-memory.dmp
memory/3888-18-0x000001AD4F850000-0x000001AD4F86E000-memory.dmp
memory/3888-25-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-23-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-22-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-11-0x000001AD37460000-0x000001AD37482000-memory.dmp
memory/3888-12-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-14-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-13-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-15-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/3888-20-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-43-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/4100-3-0x00007FF8DB3BF000-0x00007FF8DB3C0000-memory.dmp
memory/4100-0-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/4100-7-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-8-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-4-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-27-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-26-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/4100-35-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-5-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-44-0x0000000140000000-0x00000001401B8000-memory.dmp
memory/4100-45-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp
memory/4100-46-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp