a819006f0b8f3e171eabc876917836f32205432e1500d84cdfdf37417f3f7c97

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 09:20

Target
2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
Size 545KB
Sample260729-la9wpazgra
SHA256 a819006f0b8f3e171eabc876917836f32205432e1500d84cdfdf37417f3f7c97
MD5 eeb6ff941303c29d0b2a258381bfcdca
SHA1 379fe85a45a2371cc024306087108d74e463e901
SHA512 8f13d62a5e3441cf00a8c9b4cc386917fd4d0ae05bb580cd1fb1fb63497e9b18a7934abbd5ee28f2c2c7019b70c5bdb39eeaa4f7aabe2ad582a26a5bcab1d345
SSDEEP 6144:8AbSF29mAaJp2SPipYUbYIM7YERvGNPy14ffpJbnMeNXsuedRrUzyxIDHxNitAlN:CHlPie5kU4fBVLs/CzHTritYiBzFOvL
TLSH
T1D8C47D25B65900FEE163D1B8CE175903F6B2788603709FEB0384A9A61F776D85A3BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\xxxxxxxxxxxxxx,"	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDrvHost = "C:\\Windows\\system32\\xxxxxxxxxxxxxx"	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDrvHost = "C:\\Windows\\system32\\xxxxxxxxxxxxxx"	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\xxxxxxxxxxxxxxxxl	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\xxxxxxxxxxxxxxxxl	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
File created	C:\Windows\system32\xxxxxxxxxxxxxx	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\xxxxxxxxxxxxxx	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1840	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1900	1840	2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom.exe" -watch 1840
  2⤵
  PID:1900