d3181f7ad665fbcdf91f3f79128d8f523cc820892593963727e5f7e12e68a30b

General

Target
2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 958KB
Sample260712-2raqxsbw8v
SHA256 d3181f7ad665fbcdf91f3f79128d8f523cc820892593963727e5f7e12e68a30b
MD5 0ff6161465466a8716d65f2a9aea9560
SHA1 d1414897446e610498fb98b88855312ea22f122d
SHA512 efc08cb605a8fcce42a7e69989e1ef633b3b2cbe3b556934c36d76e856d5872ca2e76883f2167691ebadc6bc88eb8f942ed2a2ecabb7a5693a4e9686098da9b7
SSDEEP 24576:4AIAmUbqod3IgupAskY9Ngg0SreOqe40GGTRzPRo:45A5uotu37L3qbw9Ro
TLSH
T1B125F115F7A814F9E273813CCD638605DA727CA94770ABDF13A88A562F236D18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
812	SecurityHealthSystray.exe
1932	SecurityHealthSystray.exe
3548	DeviceSyncHost.exe
2140	GoogleUpdateCore.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2064	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2064	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2220	schtasks.exe
5024	schtasks.exe
4308	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3824	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3312 wrote to memory of 2220	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 3312 wrote to memory of 4952	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 3312 wrote to memory of 5024	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 3312 wrote to memory of 1720	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	102
PID 3312 wrote to memory of 4308	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 3312 wrote to memory of 812	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 3312 wrote to memory of 2168	3312	2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 2168 wrote to memory of 2064	2168	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_0ff6161465466a8716d65f2a9aea9560_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3824
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240682250.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2220
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4952
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240682578.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5024
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1720
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240682921.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4308
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240683140.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2064

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:1932

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 1020KB
SHA256 973ab1a3acf06f4abdf6bdfc457b71960bb4284aa6de450cdabfb35d96656df8
MD5 71624adc477fe4b01dcfdf152100bfd9
SHA1 dae1a50138c8e13f6c2a9791b65e2a847881a83c
SHA512 986970e3786728bc6b6005e8b14a14401112d26ddd46dc4e482b6000c79881c8c2c20c57bd7a1b23b3fc1dbd0cf129a4ef1a20729c92691d4e377ee9fa98c974
SSDEEP 24576:ZAIAmUbqo3cIgupAskY9Ngg0SreOqe40GGTRzPRvzKFp:Z5A5uoyu37L3qbw9RvUp
TLSH
T1E025F115FBA804F9E277813CCD638605EA727C590770ABDF13A889962F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 963KB
SHA256 acd687e3bac30e548340e907db53df2c20911c4e04f66c8de467058520267b7c
MD5 977a0fa9984b6f6cde32de7338b6c098
SHA1 d0321060723675b308bbf4ebf048826cee5c8a48
SHA512 4728eb7a3bd3fc4727e2a94191c6e45327fb6834243e1215ee05393a5ee2a7402f2a643bad73376b6c0bf4cf8ec80a0c6e82a1c59afb281de01a6d3e1542bf13
SSDEEP 24576:hAIAmUbqo1OIgupAskY9Ngg0SreOqe40GGTRzPRS:h5A5uo6u37L3qbw9RS
TLSH
T12325F115FBA814F9E273813CCD638605DA727C694770ABDF13A8895A2F236D18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240682250.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240682250.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240682578.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240682578.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240682921.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240682921.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240683140.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240683140.bat
Size 250B
SHA256 8d23c011a93b0b26ed46822e702cdff88ee642b2e8fdff7ba2d6ab2e40bf6ace
MD5 1b86604a92c88659bb57cfad80643715
SHA1 631c1b66e65d7b01021698d972586873e7f3fd71
SHA512 2d7679f6f1c8ea6015eb7aca5f7ac05ce62ad2df73b1ff2b2c8a880699a500a2bce7f1ef505ee4915e4d58d32aeda9f8925e96d9e7b955f28c28cc0de429127c
TLSH
T1EFD0971BA28AD6E00521A86B49AE398C80B1F80E0F403B838398C84D23D5909F07EBC2
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 999KB
SHA256 988a67eced12bdabf65b9d56d4a797b1d4353a2d6f631152c3edc775e980f399
MD5 68d571cca9b03d1b53fef0e6578f19d8
SHA1 6daa2bc967b814fad834ba479bf4b0208a83b823
SHA512 e998dedfedd3f7845054b0488c90bad45bc5acb439a828e2b3c5de5d48f8911cb0854cfb579ebd8759fd88e2053c5eae6a7d30ebcf88d07099b9687d5ab662f9
SSDEEP 24576:5AIAmUbqo5JIgupAskY9Ngg0SreOqe40GGTRzPRxad71:55A5uo7u37L3qbw9Rwdx
TLSH
T17B25F215FBA810F9E277813CCD638606DA727C590770ABDF13A889562F236D19E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads