7bf57bf6773de5a3ad66b52855fa2e7bbb6bad84324fa610321d9a7dc1b37199

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_f26567c5dcd47fa05a2c5f1d83dbee8e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 577KB
Sample260718-a2ezvaew8w
SHA256 7bf57bf6773de5a3ad66b52855fa2e7bbb6bad84324fa610321d9a7dc1b37199
MD5 f26567c5dcd47fa05a2c5f1d83dbee8e
SHA1 6e4449a3e8bb5851bb38664fc1fa444ae137fa5b
SHA512 f9f341c9dd95734f3f01903d747378db12d9f048af71e627859b4c6f9e10887495d44ec514d265c128bdfbcd0fe3d6eb280c7482d7152dd9d000718969204568
SSDEEP 12288:XtT93d4XtVvrjW2pNeeImyRvVQrPVNVliP:Xhhqt1WexImyMdNVliP
TLSH
T1D8C47D08E1E729FDC2A3C5BDCA135102E663B8094771ADE753D047E62E276D85F3EA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	powershell.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2100	1076	2026-07-18_f26567c5dcd47fa05a2c5f1d83dbee8e_cobalt-strike_icedid_njrat_satacom_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_f26567c5dcd47fa05a2c5f1d83dbee8e_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_f26567c5dcd47fa05a2c5f1d83dbee8e_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\t.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.zip

Path C:\Users\Admin\AppData\Local\Temp\data.zip
Size 814B
SHA256 0297530d112e25c87cab8d723823ad80e64ac4f346f37dbe645f003d2a64e6cf
MD5 0d3e544794831ad11ad0455c4c86d92a
SHA1 f8e5959e4f8587cbcdd23290d9ec99e9f337813f
SHA512 90d20cfbe162ccacf884753dab163fe1ed1d84a667ff3fb3949baed5f594723a065eea35ddc515dbc53917beb1af37cd2924c110fb7535e25f6c17e35abf336b
TLSH
T1C80141060D2F6455E25393FC3A49047952B2AC05BB2EA0443F907470EB06D92AC46E3E
MD5 SHA1 SHA512 TLSH

Submit Download

sys.dat

Path C:\Users\Admin\AppData\Local\Temp\st_zwjndt8vllodl2dt\sys.dat
Size 1KB
SHA256 69b179aa91d9567df99f9c9946ca72d6cd0d908cdcac2896caeaeaa3e4be54a9
MD5 f26d04a976cc591ac25c0717ea61e21c
SHA1 235a3eabeeaee4b31dd103d7ca59aa205d777dc6
SHA512 ad60933e372850943fcc7233fc8126c21299207505a0b7f228a6fd28c1da47bceb2d0145df37b325a34abb2b3aa1c3a4ef4228d281dbdb0f4b9505d4a2ca8383
TLSH
T1B0416A0E4845AC064737B6C75963AD0872BE6743FBE18E117CD8020D8E1FAC6DABC194
MD5 SHA1 SHA512 TLSH

Submit Download

t.ps1

Path C:\Users\Admin\AppData\Local\Temp\t.ps1
Size 230B
SHA256 6d462ed35c6e14f75b2c69a178a61da6d5e2c64f32e1c8917ea2fa45d527ce80
MD5 311c8e15ffe14fc24f8d2f61596e58ea
SHA1 1bf545fd29bccf4e30bc2c86ab29756bce8811ff
SHA512 d7f6147677732f63363cf92d6fc5e4eccbcd1fab45451230e839a80730b7309d2cdd86a5f8c3e540af52f3f8f8ff675571f41ab0b6f30c4cf01639723b7fe654
TLSH
T1A7D0A76062C6D76D4C10C0530BB2D04CDFF529457F8677419758C609E652B0EAE9A141
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2100-13-0x0000017E6B8C0000-0x0000017E6B8D2000-memory.dmp

Download

memory/2100-8-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-9-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-10-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-11-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-2-0x00007FFAC5F6F000-0x00007FFAC5F70000-memory.dmp

Download

memory/2100-15-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-6-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-16-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-12-0x0000017E6B890000-0x0000017E6B89A000-memory.dmp

Download

memory/2100-17-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-20-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/2100-3-0x0000017E6B800000-0x0000017E6B822000-memory.dmp

Download