c7298f4139d91018ccc1fa806d4f65229b10b8f8003d7ac8865eecb5d8f27ffe

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 508KB
Sample260729-c6wt9ssfre
SHA256 c7298f4139d91018ccc1fa806d4f65229b10b8f8003d7ac8865eecb5d8f27ffe
MD5 7da933b4a444e518292c5e6bc74ef941
SHA1 aad3e5df1cb96e5b9bd4d00e110896c67ae8f0bd
SHA512 6a6358eda2282f40460cccd5830040e708efc7caae16658424bee5b55efcb723d4df72613a7f5e5e80d71662bf0a6ff61538068c51038c349a5fe39d33c909f6
SSDEEP 6144:TL24DZJ8RFxDnt8Y8zn8B+HzwdiVGR2c1QrcppiyyAr:lZJ6xDntu8Swd68QrcpEy1
TLSH
T12DB49D19F76444F9E66786BCCD524805DA727C124761A6CB23A03A9F3F336E09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe
3132	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3132	powershell.exe
3132	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeIncreaseQuotaPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeTakeOwnershipPrivilege	3132	powershell.exe
Token: SeLoadDriverPrivilege	3132	powershell.exe
Token: SeSystemProfilePrivilege	3132	powershell.exe
Token: SeSystemtimePrivilege	3132	powershell.exe
Token: SeProfSingleProcessPrivilege	3132	powershell.exe
Token: SeIncBasePriorityPrivilege	3132	powershell.exe
Token: SeCreatePagefilePrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeRestorePrivilege	3132	powershell.exe
Token: SeShutdownPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeSystemEnvironmentPrivilege	3132	powershell.exe
Token: SeRemoteShutdownPrivilege	3132	powershell.exe
Token: SeUndockPrivilege	3132	powershell.exe
Token: SeManageVolumePrivilege	3132	powershell.exe
Token: 33	3132	powershell.exe
Token: 34	3132	powershell.exe
Token: 35	3132	powershell.exe
Token: 36	3132	powershell.exe
Token: SeIncreaseQuotaPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeTakeOwnershipPrivilege	3132	powershell.exe
Token: SeLoadDriverPrivilege	3132	powershell.exe
Token: SeSystemProfilePrivilege	3132	powershell.exe
Token: SeSystemtimePrivilege	3132	powershell.exe
Token: SeProfSingleProcessPrivilege	3132	powershell.exe
Token: SeIncBasePriorityPrivilege	3132	powershell.exe
Token: SeCreatePagefilePrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeRestorePrivilege	3132	powershell.exe
Token: SeShutdownPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeSystemEnvironmentPrivilege	3132	powershell.exe
Token: SeRemoteShutdownPrivilege	3132	powershell.exe
Token: SeUndockPrivilege	3132	powershell.exe
Token: SeManageVolumePrivilege	3132	powershell.exe
Token: 33	3132	powershell.exe
Token: 34	3132	powershell.exe
Token: 35	3132	powershell.exe
Token: 36	3132	powershell.exe
Token: SeIncreaseQuotaPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeTakeOwnershipPrivilege	3132	powershell.exe
Token: SeLoadDriverPrivilege	3132	powershell.exe
Token: SeSystemProfilePrivilege	3132	powershell.exe
Token: SeSystemtimePrivilege	3132	powershell.exe
Token: SeProfSingleProcessPrivilege	3132	powershell.exe
Token: SeIncBasePriorityPrivilege	3132	powershell.exe
Token: SeCreatePagefilePrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeRestorePrivilege	3132	powershell.exe
Token: SeShutdownPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeSystemEnvironmentPrivilege	3132	powershell.exe
Token: SeRemoteShutdownPrivilege	3132	powershell.exe
Token: SeUndockPrivilege	3132	powershell.exe
Token: SeManageVolumePrivilege	3132	powershell.exe
Token: 33	3132	powershell.exe
Token: 34	3132	powershell.exe
Token: 35	3132	powershell.exe
Token: 36	3132	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3132	4776	2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_7da933b4a444e518292c5e6bc74ef941_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ymi'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3132-30-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp

Download

memory/3132-31-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-35-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-34-0x000002B12EF20000-0x000002B12EF42000-memory.dmp

Download

memory/3132-36-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-37-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-41-0x000002B12F330000-0x000002B12F3E2000-memory.dmp

Download

memory/3132-40-0x000002B12F0C0000-0x000002B12F0DE000-memory.dmp

Download

memory/3132-42-0x000002B12EFA0000-0x000002B12EFAA000-memory.dmp

Download

memory/3132-43-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-44-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-45-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-46-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-48-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-49-0x000002B12EFB9000-0x000002B12EFBF000-memory.dmp

Download

memory/3132-50-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/3132-51-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download