d31695222f7a46f728516b0f3a550ebddc5dc167a00476a54e0dfbf243b91bc1

Analysis

max time kernel
79s
max time network
81s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.7MB
Sample260713-l4chaafs8j
SHA256 d31695222f7a46f728516b0f3a550ebddc5dc167a00476a54e0dfbf243b91bc1
MD5 e253435ad2b6c1b4ca6bd2f43283bd04
SHA1 bdc8148cce2e4140ca90cd19e0ebc2679b9e589d
SHA512 6c1d5ae611d05bf25fbda72ca09175e81d42da8c87d0746865a585b9d98570d3b8f7d78b752aa699ec56e82af2d364b20a3da7d81b7c888812497b24c33f3651
SSDEEP 24576:/rnIMZ5ocvYcu/B49UMz2dfthwaCu1iSrkfs/RRG0wHTi4J:7Ikocwxqu62dVhBJ5kIG06J
TLSH
T164857D17A37800EDD167C1B8CA165607EB71744A1334AADF13D09AA62F23AE55F7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c4-8.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1756	powershell.exe
1756	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ImeNotifyIcon.exe	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.exe	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe\:Zone.Identifier:$DATA	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe:Zone.Identifier	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
648	ThemeMonitor.exe
5816	ThemeMonitor.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdaterSvc = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdaterSvc = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Personalization\\ThemeMonitor.exe"	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe:Zone.Identifier	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe:Zone.Identifier	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\:Zone.Identifier:$DATA	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe:Zone.Identifier	ThemeMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
1756	powershell.exe
1756	powershell.exe
900	WMIC.exe
900	WMIC.exe
900	WMIC.exe
900	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
2556	WMIC.exe
5348	WMIC.exe
5348	WMIC.exe
5348	WMIC.exe
5348	WMIC.exe
2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeIncreaseQuotaPrivilege	1756	powershell.exe
Token: SeSecurityPrivilege	1756	powershell.exe
Token: SeTakeOwnershipPrivilege	1756	powershell.exe
Token: SeLoadDriverPrivilege	1756	powershell.exe
Token: SeSystemProfilePrivilege	1756	powershell.exe
Token: SeSystemtimePrivilege	1756	powershell.exe
Token: SeProfSingleProcessPrivilege	1756	powershell.exe
Token: SeIncBasePriorityPrivilege	1756	powershell.exe
Token: SeCreatePagefilePrivilege	1756	powershell.exe
Token: SeBackupPrivilege	1756	powershell.exe
Token: SeRestorePrivilege	1756	powershell.exe
Token: SeShutdownPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeSystemEnvironmentPrivilege	1756	powershell.exe
Token: SeRemoteShutdownPrivilege	1756	powershell.exe
Token: SeUndockPrivilege	1756	powershell.exe
Token: SeManageVolumePrivilege	1756	powershell.exe
Token: 33	1756	powershell.exe
Token: 34	1756	powershell.exe
Token: 35	1756	powershell.exe
Token: 36	1756	powershell.exe
Token: SeIncreaseQuotaPrivilege	900	WMIC.exe
Token: SeSecurityPrivilege	900	WMIC.exe
Token: SeTakeOwnershipPrivilege	900	WMIC.exe
Token: SeLoadDriverPrivilege	900	WMIC.exe
Token: SeSystemProfilePrivilege	900	WMIC.exe
Token: SeSystemtimePrivilege	900	WMIC.exe
Token: SeProfSingleProcessPrivilege	900	WMIC.exe
Token: SeIncBasePriorityPrivilege	900	WMIC.exe
Token: SeCreatePagefilePrivilege	900	WMIC.exe
Token: SeBackupPrivilege	900	WMIC.exe
Token: SeRestorePrivilege	900	WMIC.exe
Token: SeShutdownPrivilege	900	WMIC.exe
Token: SeDebugPrivilege	900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	900	WMIC.exe
Token: SeRemoteShutdownPrivilege	900	WMIC.exe
Token: SeUndockPrivilege	900	WMIC.exe
Token: SeManageVolumePrivilege	900	WMIC.exe
Token: 33	900	WMIC.exe
Token: 34	900	WMIC.exe
Token: 35	900	WMIC.exe
Token: 36	900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	900	WMIC.exe
Token: SeSecurityPrivilege	900	WMIC.exe
Token: SeTakeOwnershipPrivilege	900	WMIC.exe
Token: SeLoadDriverPrivilege	900	WMIC.exe
Token: SeSystemProfilePrivilege	900	WMIC.exe
Token: SeSystemtimePrivilege	900	WMIC.exe
Token: SeProfSingleProcessPrivilege	900	WMIC.exe
Token: SeIncBasePriorityPrivilege	900	WMIC.exe
Token: SeCreatePagefilePrivilege	900	WMIC.exe
Token: SeBackupPrivilege	900	WMIC.exe
Token: SeRestorePrivilege	900	WMIC.exe
Token: SeShutdownPrivilege	900	WMIC.exe
Token: SeDebugPrivilege	900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	900	WMIC.exe
Token: SeRemoteShutdownPrivilege	900	WMIC.exe
Token: SeUndockPrivilege	900	WMIC.exe
Token: SeManageVolumePrivilege	900	WMIC.exe
Token: 33	900	WMIC.exe
Token: 34	900	WMIC.exe
Token: 35	900	WMIC.exe
Token: 36	900	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3336	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 3336 wrote to memory of 1756	3336	cmd.exe	88
PID 2224 wrote to memory of 5732	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 5732 wrote to memory of 1248	5732	cmd.exe	92
PID 2224 wrote to memory of 3316	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 3316 wrote to memory of 900	3316	cmd.exe	95
PID 2224 wrote to memory of 2656	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 2656 wrote to memory of 2556	2656	cmd.exe	98
PID 2224 wrote to memory of 2996	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 2996 wrote to memory of 5348	2996	cmd.exe	101
PID 2224 wrote to memory of 3020	2224	2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 3020 wrote to memory of 1048	3020	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Drops startup file
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c shutdown /s /t 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\shutdown.exe
    shutdown /s /t 0
    3⤵
    PID:1048

C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5816

C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:648

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.7MB
SHA256 d31695222f7a46f728516b0f3a550ebddc5dc167a00476a54e0dfbf243b91bc1
MD5 e253435ad2b6c1b4ca6bd2f43283bd04
SHA1 bdc8148cce2e4140ca90cd19e0ebc2679b9e589d
SHA512 6c1d5ae611d05bf25fbda72ca09175e81d42da8c87d0746865a585b9d98570d3b8f7d78b752aa699ec56e82af2d364b20a3da7d81b7c888812497b24c33f3651
SSDEEP 24576:/rnIMZ5ocvYcu/B49UMz2dfthwaCu1iSrkfs/RRG0wHTi4J:7Ikocwxqu62dVhBJ5kIG06J
TLSH
T164857D17A37800EDD167C1B8CA165607EB71744A1334AADF13D09AA62F23AE55F7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveAaawat.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe:Zone.Identifier
Size 26B
SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
MD5 cb9db8b13f2e7d1ae122b5b6c2381b25
SHA1 ea06df82dba8cc567e95c43e6214872e52fdb05b
SHA512 937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0
MD5 SHA1 SHA512

Submit Download

memory/1756-26-0x000001C5781D0000-0x000001C578282000-memory.dmp

Download

memory/1756-25-0x000001C577FF0000-0x000001C57800E000-memory.dmp

Download

memory/1756-15-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-16-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-17-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-18-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-19-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-20-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-21-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-27-0x000001C577FE0000-0x000001C577FEA000-memory.dmp

Download

memory/1756-14-0x000001C577F60000-0x000001C577F82000-memory.dmp

Download

memory/1756-11-0x00007FFD2973F000-0x00007FFD29740000-memory.dmp

Download

memory/1756-22-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-28-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-29-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-30-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-31-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-32-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-33-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-34-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-35-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/1756-37-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads