6ea210c873ee0536f8acebeff2d15638962810e7146785b0eaf54388cecf29f6

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.9MB
Sample260711-ca533aav2n
SHA256 6ea210c873ee0536f8acebeff2d15638962810e7146785b0eaf54388cecf29f6
MD5 03eabada40ca282b2ee449afadc0fd11
SHA1 fc92d33b35428c7d230056b332674bf773f90827
SHA512 c497831096d57d550b7a13ac3c2886f28136a7a9688d76d1e5ca1f9342823ac4603625f9d8790e62acf28698586e66157f14956e25b5acf8a424ea1fee7ba99c
SSDEEP 24576:PrtbTaCDTSvF2HhUsizFU/nQdjXthtI1tq43pSjgo5yMDJY:PZqCDOcHmsizS/Qxy1Wj
TLSH
T1E5958D17A37900EDD177C1B88A165607EBB1744A0334AADF13D0D9A62F23EE16B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c467-8.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3900	powershell.exe
3900	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImeNotifyIcon.exe	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe\:Zone.Identifier:$DATA	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe:Zone.Identifier	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
3436	ThemeMonitor.exe
5008	ThemeMonitor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdaterSvc = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdaterSvc = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe:Zone.Identifier	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe:Zone.Identifier	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\:Zone.Identifier:$DATA	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
3900	powershell.exe
3900	powershell.exe
6004	WMIC.exe
6004	WMIC.exe
6004	WMIC.exe
6004	WMIC.exe
4344	WMIC.exe
4344	WMIC.exe
4344	WMIC.exe
4344	WMIC.exe
5928	WMIC.exe
5928	WMIC.exe
5928	WMIC.exe
5928	WMIC.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeIncreaseQuotaPrivilege	3900	powershell.exe
Token: SeSecurityPrivilege	3900	powershell.exe
Token: SeTakeOwnershipPrivilege	3900	powershell.exe
Token: SeLoadDriverPrivilege	3900	powershell.exe
Token: SeSystemProfilePrivilege	3900	powershell.exe
Token: SeSystemtimePrivilege	3900	powershell.exe
Token: SeProfSingleProcessPrivilege	3900	powershell.exe
Token: SeIncBasePriorityPrivilege	3900	powershell.exe
Token: SeCreatePagefilePrivilege	3900	powershell.exe
Token: SeBackupPrivilege	3900	powershell.exe
Token: SeRestorePrivilege	3900	powershell.exe
Token: SeShutdownPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeSystemEnvironmentPrivilege	3900	powershell.exe
Token: SeRemoteShutdownPrivilege	3900	powershell.exe
Token: SeUndockPrivilege	3900	powershell.exe
Token: SeManageVolumePrivilege	3900	powershell.exe
Token: 33	3900	powershell.exe
Token: 34	3900	powershell.exe
Token: 35	3900	powershell.exe
Token: 36	3900	powershell.exe
Token: SeIncreaseQuotaPrivilege	6004	WMIC.exe
Token: SeSecurityPrivilege	6004	WMIC.exe
Token: SeTakeOwnershipPrivilege	6004	WMIC.exe
Token: SeLoadDriverPrivilege	6004	WMIC.exe
Token: SeSystemProfilePrivilege	6004	WMIC.exe
Token: SeSystemtimePrivilege	6004	WMIC.exe
Token: SeProfSingleProcessPrivilege	6004	WMIC.exe
Token: SeIncBasePriorityPrivilege	6004	WMIC.exe
Token: SeCreatePagefilePrivilege	6004	WMIC.exe
Token: SeBackupPrivilege	6004	WMIC.exe
Token: SeRestorePrivilege	6004	WMIC.exe
Token: SeShutdownPrivilege	6004	WMIC.exe
Token: SeDebugPrivilege	6004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6004	WMIC.exe
Token: SeRemoteShutdownPrivilege	6004	WMIC.exe
Token: SeUndockPrivilege	6004	WMIC.exe
Token: SeManageVolumePrivilege	6004	WMIC.exe
Token: 33	6004	WMIC.exe
Token: 34	6004	WMIC.exe
Token: 35	6004	WMIC.exe
Token: 36	6004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6004	WMIC.exe
Token: SeSecurityPrivilege	6004	WMIC.exe
Token: SeTakeOwnershipPrivilege	6004	WMIC.exe
Token: SeLoadDriverPrivilege	6004	WMIC.exe
Token: SeSystemProfilePrivilege	6004	WMIC.exe
Token: SeSystemtimePrivilege	6004	WMIC.exe
Token: SeProfSingleProcessPrivilege	6004	WMIC.exe
Token: SeIncBasePriorityPrivilege	6004	WMIC.exe
Token: SeCreatePagefilePrivilege	6004	WMIC.exe
Token: SeBackupPrivilege	6004	WMIC.exe
Token: SeRestorePrivilege	6004	WMIC.exe
Token: SeShutdownPrivilege	6004	WMIC.exe
Token: SeDebugPrivilege	6004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6004	WMIC.exe
Token: SeRemoteShutdownPrivilege	6004	WMIC.exe
Token: SeUndockPrivilege	6004	WMIC.exe
Token: SeManageVolumePrivilege	6004	WMIC.exe
Token: 33	6004	WMIC.exe
Token: 34	6004	WMIC.exe
Token: 35	6004	WMIC.exe
Token: 36	6004	WMIC.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4180	5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	87
PID 4180 wrote to memory of 3900	4180	cmd.exe	89
PID 5096 wrote to memory of 4488	5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 4488 wrote to memory of 2532	4488	cmd.exe	93
PID 5096 wrote to memory of 4176	5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 4176 wrote to memory of 6004	4176	cmd.exe	96
PID 5096 wrote to memory of 1792	5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 1792 wrote to memory of 4344	1792	cmd.exe	103
PID 5096 wrote to memory of 1396	5096	2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 1396 wrote to memory of 5928	1396	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Drops startup file
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5928

C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3436

C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.9MB
SHA256 6ea210c873ee0536f8acebeff2d15638962810e7146785b0eaf54388cecf29f6
MD5 03eabada40ca282b2ee449afadc0fd11
SHA1 fc92d33b35428c7d230056b332674bf773f90827
SHA512 c497831096d57d550b7a13ac3c2886f28136a7a9688d76d1e5ca1f9342823ac4603625f9d8790e62acf28698586e66157f14956e25b5acf8a424ea1fee7ba99c
SSDEEP 24576:PrtbTaCDTSvF2HhUsizFU/nQdjXthtI1tq43pSjgo5yMDJY:PZqCDOcHmsizS/Qxy1Wj
TLSH
T1E5958D17A37900EDD177C1B88A165607EBB1744A0334AADF13D0D9A62F23EE16B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brd4FAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\brd4FAB.tmp
Size 138KB
SHA256 d1e2362431d3a621a0e59352e5db0311b3aeb46de43089e61b7df0bc2d357c72
MD5 65bb6304be3925ec27f5d2094248e04a
SHA1 271e4c39a44d4a381840b5a02a6a9b2951c7f220
SHA512 6111a80e2cc61d256b3f0f961cc137b0871ff443cea5909c674a6ab4776a958321e74a61b33fd7ecb50130df0e82580dd01e6327cba493f77eb32fc7d64fb087
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Oa1+hVumSVn+a:FnbZeMrv/hGta1+sn+a
TLSH
T108D3984B3A747502EDE59A722CE0517F5E3C716D8F1591D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brd4FAD.tmp

Path C:\Users\Admin\AppData\Local\Temp\brd4FAD.tmp
Size 256KB
SHA256 b73c1dc4f6259e97679546041efc830042a6a71792ea2769900e3c5b9d101265
MD5 a855c232516a65c09426696b9240c50c
SHA1 30942c6eb3b85267543298c861f7cba842292a4c
SHA512 ca847255d41ce9ef8cb491ffd09e75990f0615191e8a04527f3dffe083d435cc754574f51e93c39877373a476c101ac39a498a2d40ed244db3c25fa7048bc52c
SSDEEP 384:K8NTRZyCSDnxTICBMEhIKyll7svbFKfk7:KoNZJSDnijyI1l7svbF9
TLSH
T1EF44840A7B747001EDE6DD721CB080771E3C716E8F22A6916DA654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckd4F6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\ckd4F6E.tmp
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckd4F82.tmp

Path C:\Users\Admin\AppData\Local\Temp\ckd4F82.tmp
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsk4F97.tmp

Path C:\Users\Admin\AppData\Local\Temp\lsk4F97.tmp
Size 4KB
SHA256 81b8c6192ff95866cc6832196168152f8e1273a2550158517b0b1610ef5ac642
MD5 8c5475d990db97205ad010cff85ae5ec
SHA1 4071e18741146a535c206993c71e05db2d5b0e6a
SHA512 d87eaaadd49be236ffb7cf90ac81dde390e28714f475d89a3a11f6039471914170bfb8665f62b21064120d0033d4abe96113b25387f5594389503a15a8b95334
SSDEEP 96:xC61d+r2io+TJ/E0f6m934zM4RDotok5E1mDEB6nGyvn0bPT8aybJV4a:xC2ITo+TQ0InDUDBoPPbPT8aybn
TLSH
T1CFA10736A0284D775476D449B1623A83CFA97067E9B2EFE4EAE90F0C25F74EC1341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsk4F99.tmp

Path C:\Users\Admin\AppData\Local\Temp\lsk4F99.tmp
Size 38KB
SHA256 7eed7580cf44c2ff39599cdcd076be9d6bab360193a8fa0e4280cfc8405515b4
MD5 340104fb930a577b4e9c1bb5d7fcf55f
SHA1 4b16c68bef66b77c715a825e0ab17f0b3688dd5c
SHA512 c76b7ec4e09d84437c750316abccc8732ffde8ef0e63bf82e92d718785f73a8683b505ba033d90ba43984f72c68b6bc99ae47fa4a5cc20599f64b4defd0e50a2
SSDEEP 768:hrv+4UNbdz3OY/TBOWQttfONXyer1IRCzniBteVH1Sl:hbsbV3h8SIqn2EH1s
TLSH
T13D03CF36A4A89E338DE2A3C6B14777037FF86057C6840B90D9DE1F4E069B99E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveAaawat.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download

memory/3900-27-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-30-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-25-0x0000021A1D080000-0x0000021A1D132000-memory.dmp

Download

memory/3900-26-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-24-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-28-0x0000021A1CDD0000-0x0000021A1CDDA000-memory.dmp

Download

memory/3900-23-0x0000021A1CDB0000-0x0000021A1CDCE000-memory.dmp

Download

memory/3900-29-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-20-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-32-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-18-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-16-0x0000021A1CCF0000-0x0000021A1CD12000-memory.dmp

Download

memory/3900-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/3900-11-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp

Download