5f292dec08b6c575390112c34f681558add4b952148be922bdd118a0786e65ae

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 635KB
Sample260715-lmk34act3x
SHA256 5f292dec08b6c575390112c34f681558add4b952148be922bdd118a0786e65ae
MD5 9d6ce01929333b89bcecf77ef9197747
SHA1 2b4a2df58eebb467b6460ccf3c7cf5be0209e44b
SHA512 a117bed82d07615914bb6f07d20b777f918b4c0d3a649388f4a36721f488381dab9c88f74d5e76c70c3d82cd851c1ada1d2774fbc4a52c64ebcab0f02163fb9e
SSDEEP 12288:ZRsyzDVj57EkyQV636zzq8db6ubMrbdbMdbp:TzDVjLyQViGHdb6u4ndbMdbp
TLSH
T11DD47E06B7E914FAE5778538C9A34902EB337C664760EADF039046A64F277D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3620	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
3620	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
3620	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
3620	2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d6ce01929333b89bcecf77ef9197747_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads