Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 08:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 372KB
- Sample260714-j9cdcsbw9s
- SHA256 45a009db2a9fd0ed3e5d11d26b871b0c31448d36bb44d421fdcafe08bc31d92f
- MD5 efa86cf7868fe8719f5fa00b29341d88
- SHA1 c1356bd441ff53f2a2b9f9fca06c4f747dab1973
- SHA512 5b4234d2ad003cbffdde91d110cfeada96ed41e146cc2660d8f2936285a2382ebc7ea9128623592a21a5729c22824ca3a2f2d80bddb426443d6bac782b8149e5
- SSDEEP 6144:p7eQbiOe5kpT9ZN58y4/hoVPbuVQJUDlAqnVdmeu:xnbiOTJN58y48jKQJ0lfnVdfu
- TLSH T13C848D15FBA500FAE1BB8178C9624502D7727C5E0770AEDF23A44A961F236E49F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2188 sc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5024 wrote to memory of 3448 5024 2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe 88 PID 3448 wrote to memory of 2188 3448 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_efa86cf7868fe8719f5fa00b29341d88_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\system32\sc.exesc start vgc3⤵
- Launches sc.exe
PID:2188
-
-