76f15ee0b774a73b572d373632cba935a30cffd2c4ece876cfc4c560ea411fdb

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:54

Target
2026-07-22_1e41a171ef5e2be149714f1ad7571790_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 899KB
Sample260722-tcgxpagh35
SHA256 76f15ee0b774a73b572d373632cba935a30cffd2c4ece876cfc4c560ea411fdb
MD5 1e41a171ef5e2be149714f1ad7571790
SHA1 7f37c1263e8b2edf7e8b31c6b818a36b9767356d
SHA512 d29d2a0e791b211f081f9a395666ed6ea6f89ac978588025d80efdf66dc2f502e6fef69092620e52335c9423400670a3b70fd95035b9c85260c609e67f797a3d
SSDEEP 24576:iAIAmUbqo7TRK/nsVtEnE4bSCp0xBQwVWbW+BI35k0tJ:i5A5uo/FwnE4bSztWb23/tJ
TLSH
T1F415F115FBA804F9E277C578CD634602EA727C9A07609BCF13548A962F23AD49F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-07-22_1e41a171ef5e2be149714f1ad7571790_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_1e41a171ef5e2be149714f1ad7571790_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2844