4c5b72b3fcd9ef8fa7e327f33f180f18b9cea5c290f8785fbc3c48aaa115ad2a

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_b7dc74aed948a0b18d60baf18aebb675_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 354KB
Sample260713-kgtydaf16w
SHA256 4c5b72b3fcd9ef8fa7e327f33f180f18b9cea5c290f8785fbc3c48aaa115ad2a
MD5 b7dc74aed948a0b18d60baf18aebb675
SHA1 eba780011a8d54808fc2a252aeecad1d19d63472
SHA512 48f96fa14110b24ef66c92fcb3b32982f38da13d84e6b1e831f28da446c454478c3a2d312e893b8cf6b44f951573970eceb8c87886426a9c949a3e6a5bb7e3c1
SSDEEP 6144:1KR05vtEFoW7ajESw/dInoS0p4jYg9+XvalyCi8m19ov4NW9+bbHq:1tEF0FfY58m19zNW
TLSH
T1BE746C28EA9415F9E177D578CAA35403EB727C4A4B349AFF239056660F236D0CE3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-07-13_b7dc74aed948a0b18d60baf18aebb675_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_b7dc74aed948a0b18d60baf18aebb675_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_b7dc74aed948a0b18d60baf18aebb675_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Modifies registry class
PID:5108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profiles.json

Path C:\Users\Admin\AppData\Roaming\MinecraftModLoader\profiles.json
Size 4KB
SHA256 207d7bb6889385e6d7f5707f2b7f91c62140e67cccc421dd4d8f89b1520122d4
MD5 e78f3a31ccda53ed85415c3c5a4b2a84
SHA1 fe3efbbb6ea6d9aa5cdcb1d96373526d0afac51d
SHA512 220177ae4ab20b939f81f344d9991c262b60a29a80800e1ca0e0fcf0b4a86a389731e1b9d5837b7d3f3a8f1e6d35ccf0c983c460f11a908ddf3e115650615c4f
SSDEEP 96:ZdlGdlzdl5dljdlFdlLdlZdl7dlodlzdlvdlPdlLdlLdlV5dl/dl3zdl+adla:XlKlRl3lhlLlplXl5lElRlFlllplplV8
TLSH
T1B3913720D8E66F3A84DBBC58B531EA2723D19D97198DFC0DDF676CC8260E12A04B546E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download