Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/07/2026, 02:23
General
- Target 2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 2.9MB
- Sample260720-ct4pcacv5k
- SHA256 8e0db05d8f382374c5cfccc420b62bf5c34deb636da3d05b7fc68bf997a90df3
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe" --worker2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3460-3-0x0000021564FE0000-0x0000021564FE1000-memory.dmp
memory/3460-2-0x0000021564FD0000-0x0000021564FD1000-memory.dmp
memory/3460-1-0x0000021564FC0000-0x0000021564FC1000-memory.dmp
memory/3460-13-0x0000021565080000-0x0000021565081000-memory.dmp
memory/3460-12-0x0000021565070000-0x0000021565071000-memory.dmp
memory/3460-11-0x0000021565060000-0x0000021565061000-memory.dmp
memory/3460-10-0x0000021565050000-0x0000021565051000-memory.dmp
memory/3460-9-0x0000021565040000-0x0000021565041000-memory.dmp
memory/3460-8-0x0000021565030000-0x0000021565031000-memory.dmp
memory/3460-7-0x0000021565020000-0x0000021565021000-memory.dmp
memory/3460-6-0x0000021565010000-0x0000021565011000-memory.dmp
memory/3460-5-0x0000021565000000-0x0000021565001000-memory.dmp
memory/3460-4-0x0000021564FF0000-0x0000021564FF1000-memory.dmp