97c187315c2d337afb87ceb057ed69e7eed4e8d6d183deecee67dd32307ea6b2

General

Target
2026-07-14_0909e7691f747eb8fe04f5b1a6510703_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Size 5.9MB
Sample260714-e8th2agw8s
SHA256 97c187315c2d337afb87ceb057ed69e7eed4e8d6d183deecee67dd32307ea6b2
MD5 0909e7691f747eb8fe04f5b1a6510703
SHA1 dbe7a48d2638588b414626e2e9437a2b62973248
SHA512 e96d9459063033365c465bb91cee696ddd548bc6224d36ef921643a6a9622fc4c7d44fcfed935d0598366b86eede3a121b7b5abad4774ae93ba9f048b6722e61
SSDEEP 98304:SqwEWGy4RDnOz8250ozwEmSZbY9aMO1TKnmz9wHacbKlQLV45LWflTzR6GlM92aL:Sqw3D4RDnOz8PozwEdbI81TKmzQacbKB
TLSH
T15756231EE39905F9D0B3E578E99B8903F2BE3C4D03209A4F13A5655B2F537A09E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence privilege_escalation spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-07-14_0909e7691f747eb8fe04f5b1a6510703_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
964	pazoACNeWH.exe

Loads dropped DLL 1 IoCs

pid	Process
964	pazoACNeWH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D9FFAC78CA5320E3A9BBEA66530116C1C93F7ED7\Blob = 1900000001000000100000004ba2128ad13212d4c00e8251b0bfe5cc0f0000000100000020000000d65a7314b6a0ccb15275dc76db0957c077df41c0ee64e863c0f2d493a71151d3040000000100000010000000ca46d9fa545f7a4a19cc9dcd837d83d3030000000100000014000000d9ffac78ca5320e3a9bbea66530116c1c93f7ed7140000000100000014000000c3eaf5b9aef99fcb4b50f4169599191aa9bd02a72000000001000000d5030000308203d1308202b9a003020102020841598a84dbb9f3ed300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f742043413020170d3030303232353030303030305a180f32303939303132343233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f06035504031338446967694365727420547275737465642047342054696d655374616d70696e6720525341343039362053484132353620323032352043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100dc3a2cda4511df2d3a7fccc6fd2b316abb4344bfddb3ab3c7bf5e610cf577f12d39b792b7ede25b582401c6c4b6af6294718da0afe2445f3f95f11d3454ee5ce30adf4664c4faadaf5a4717df00b7d824233a7f5c8525e4a6518e310eff4ed1c7219d774cae591d5df0b04936306ad072a9d3d03e4bffc13b0324ace57b4b0b1f503363f99d1f28ef7396cb7a1cbc40df875b50184f8a9bf722e52d82d0cc876e9682bd7641c6ac4527f9f2adab5d000881263d92b6c3005f07a00065e915ad4876b4e4e5f66d811fc12b278beac1fac2bba453c56582f0211210650b17a1f72a70bd3d037d658874c94438c419d4f79c293a10e7e30c454066084733ae1e21b0203010001a37f307d30090603551d1304023000301d0603551d0e04160414c3eaf5b9aef99fcb4b50f4169599191aa9bd02a7301f0603551d23041830168014c3eaf5b9aef99fcb4b50f4169599191aa9bd02a7300e0603551d0f0101ff0404030202ac30200603551d250101ff0416301406082b0601050507030306082b06010505070308300d06092a864886f70d01010b0500038201010055cf4f89d887f8b8dea4fcc8290a1d7a545bdcbcc7fb05e48395fe94a02917501fa238d6aae2759cfea6334df1b368c42ebd4550233bbd81dffa22470f225186aff45954fbd87c4d0aa4c7580a0a0200e729bf860c3bf18a95c609563d15a37a47320884e48eae38e206e7ceae3a7d7b10b96a9e8bbc1027a79e05f2b93b540027ca4132f2ab4b9dc82da3e416a6835ed808f473617db1ee4e1ef3c489a10972fd8652d8c0dbceca70203b7af9f3941119a866e8601b1e11c3c555f59be2ba74b518c6ce6137f8bbfb82d5f375e98641b6c0399d848c6df8c8ebdbbdc7ef1ca175406d28aa4a9106ad3912366373cb7ddbbcbc5cd7eca3e25299a4e5ab2d8654	pazoACNeWH.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1004	taskkill.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D9FFAC78CA5320E3A9BBEA66530116C1C93F7ED7	pazoACNeWH.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3212	regedit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 556	1068	2026-07-14_0909e7691f747eb8fe04f5b1a6510703_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	85
PID 556 wrote to memory of 1004	556	cmd.exe	88
PID 556 wrote to memory of 3212	556	cmd.exe	90
PID 556 wrote to memory of 964	556	cmd.exe	91
PID 964 wrote to memory of 528	964	pazoACNeWH.exe	93
PID 528 wrote to memory of 4568	528	cmd.exe	94
PID 4568 wrote to memory of 2312	4568	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0909e7691f747eb8fe04f5b1a6510703_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0909e7691f747eb8fe04f5b1a6510703_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmrxwSF15S.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- - C:\Windows\regedit.exe
    regedit /s 23444.reg
    3⤵
    - Runs .reg file with regedit
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\pazoACNeWH.exe
    pazoACNeWH.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd /c netsh winsock reset > nul 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Windows\system32\cmd.exe
        
        cmd /c netsh winsock reset
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
      - C:\Windows\system32\netsh.exe
        
        netsh winsock reset
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23444.reg

Path C:\Users\Admin\AppData\Local\Temp\23444.reg
Size 7KB
SHA256 fcf31397a44bd3adc493adf8d83d9f1a491310fcd705e692f18b72722d2ab68a
MD5 fd7ad80a25a5c277459b45e7657cc7ad
SHA1 bb74ccb53c1419de2bd0dc8fc5dd3bc84cf052bd
SHA512 5f87efcd71af067737dae04ae7d8d356d5bbc94b4afa357d196c2ea2b946770cc901af9855bd0d80cea5eed39a2e7f84900bf6b7c543d8beaa0472a95ec76dbb
SSDEEP 192:HNdFUTCW53EbttcPGtcmV8cPm1m/gcqKdoFe+IH:HNdFUTN53EbttXHdgcqKdo/o
TLSH
T1E6F18E3ACFA5052B81778D79CEF745A3EE5B2403322DDC4A44C737420D63A8A799636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SProtectSDK64.dll

Path C:\Users\Admin\AppData\Local\Temp\SProtectSDK64.dll
Size 1.7MB
SHA256 db67f9d7e6ce3bef1faa6dc45f6130ae5b3472bfa188dbd41f513450b1d2e046
MD5 680f243593b10264192aab5e1cf8f489
SHA1 b7edd7206c48a1847ce7e428aacb72f23e9b9d8f
SHA512 dd776e101952b8ce300ba71e59b3377d4e8debcc44b06862884f397080884fc4811b2fdb028d76d71ae17c65988710077ad251733ee4bc1ed0c2f0471b472bea
SSDEEP 24576:0g39wtZaqxfffWkQ1osGl4eQJBEfY8bVBtKWTEil7rFfDfJoV/Df5yjEgM7UsdxB:93GNx3fxKz6s6P1L7rS5oMws7vZ3
TLSH
T14F85F1816AC113BCC09EC378C5133C0DF379BFE55914959A27CA6A119E33BE89B36B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pazoACNeWH.exe

Path C:\Users\Admin\AppData\Local\Temp\pazoACNeWH.exe
Size 5.1MB
SHA256 80e9b8d2bdde55ac1e3cbf0861b6f0271fcbb59da68788cf8d1a0514e78a57db
MD5 69e9f00dd0eab7f485aeda5bb6bb7697
SHA1 a02c865f40dcbc2ed1ef2ca8fbb109df517bd2a1
SHA512 08a3bced3223f8ad558db47758de00cf2ec5a6d910ddf78d5d4fffb0074aca37d49286f499af9a60874bdfaa09eca4dc1267bb90c98c9b888370b71ab678c099
SSDEEP 98304:ZB2H2amUXrs0iFpHPoOaICHDrNUuFJVcep5IFONNLvYtSCdrIwLx+PVr9jwGQ0W0:H2H2amUXrs0iFpHPg9nWoJucfvPyr/Lm
TLSH
T19F3601DA19C309FFE059CFB06212706E70BAB35B7E360DCBA459D5184C351D88EB279A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.bat

Path C:\Users\Admin\AppData\Local\Temp\run.bat
Size 206B
SHA256 1696b4bfb05ff6ae37d65b32191767069a4d46e85de2c34163fb13e748a1fdc0
MD5 14c32e15c77fa101afe8edf6e13158ef
SHA1 d6d489e040b82a7daf6bad5c01ffc82e4828341e
SHA512 811fa1c0d8f14dd3586d44078de9b226cc7fcf78cc1a67659267e5ebc96f3fb30b09d566129c6db7427196f95a3ce55607a16aa78e89b56a2a9b60d0389f20fd
TLSH
T1F7D01201F5018E502A4745C8F6DE03ECB55AC8C2247456BE219778AD515E474D2F6AC9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-17-0x00007FFC1A910000-0x00007FFC1AAD7000-memory.dmp

Download

memory/964-19-0x0000000140000000-0x000000014051D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads