fe27c15f7855522ebaa5b1ea52d5e6b056713a0a870a1069ed032d54a2d2675b

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 365KB
Sample260727-vmm25axdpc
SHA256 fe27c15f7855522ebaa5b1ea52d5e6b056713a0a870a1069ed032d54a2d2675b
MD5 3644ec9cb53f3f3f22d9d4e134833b17
SHA1 b20b882fa879e3f1969328696610a1f0293837b0
SHA512 27d58e982bf03732ba22c090ae4196280bd8f8fb4ab24368f26a31e1f292848db1d4ff81362240ce4a746449acec76080ecdd27f8594fd17055692c585952b2c
SSDEEP 3072:zg+R3S67Gie2MNwZBO8wMf0qMcOcrfMskmi6H6B6x83cpD1b3lSfRU1qm8eawmJT:COtkmi6H6B6x83YDLyneaABq3miAi4Q
TLSH
T1A7845C4AFBA514F5E5BBC138C952651AFD717CA24370A78F63904A572F23BA0AE3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 120 created 1104	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4168	sc.exe
7148	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1076	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 120 wrote to memory of 1076	120	2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 1076 wrote to memory of 4168	1076	cmd.exe	94
PID 1076 wrote to memory of 7148	1076	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_3644ec9cb53f3f3f22d9d4e134833b17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120
- C:\Windows\system32\winver.exe
  C:\Windows\system32\winver.exe
  2⤵
  PID:3768
- C:\Windows\system32\ComputerDefaults.exe
  C:\Windows\system32\ComputerDefaults.exe
  2⤵
  PID:1104
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel & sc start moimoi
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\sc.exe
      sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel
      4⤵
      Launches sc.exe
      PID:4168
  - - C:\Windows\system32\sc.exe
      sc start moimoi
      4⤵
      Launches sc.exe
      PID:7148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\a
Size 11KB
SHA256 46dfd42b084a2494c2896ccdb9d4b35f752dd0c3dfcbd3040adf6645b26df2f9
MD5 11aa91e9fd0a57138e0d294fa31928c3
SHA1 8dde7fe9e2cad434aef4953db0d3b11f3bdb7a9a
SHA512 8bd5b4410c55a2734c2e631963592fffce584f20bc457d3abfc3e55ecc47ee161022fdf6cd6ec7e3b19656bb9f80f299776c9c3fa916552e167af45dfecf6e93
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzo9UfkUL49Ggn8RxdJ6T:sXX+/DV7k/3pkULYUxdJ6T
TLSH
T15932094CEED022B4F27313DD77AB2969222455CB1448C484FE8CADE47F07B9C8267B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-18-0x0000022F3DE20000-0x0000022F3DE23000-memory.dmp

Download