Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe
- Size 169KB
- Sample260802-bbpxssbb94
- SHA256 328b73b86bca752a6644f0848622009d37d8d9cd0af16ad9a5497ea8cebc854e
- MD5 3a7e81545b056d88ca351ea600a1f900
- SHA1 736de05474df5b6414bc69ca6072caba6ca57edb
- SHA512 88a690c9c0430c4b2bc3ae297c8caa3aa5276daa470983bcd18b79170edc87ec372b0233a9275a1695072efcaec6dcd0b1799b07a9fd78205b7262e669a060c2
- SSDEEP 3072:e9m3OTvaX+aDU2uiUnj+Ld39ksUFK6LyfE4l505:WT++kI4dtRTp
- TLSH T1D9047C57B3E520F9E1738639C9A10646E772B83217209BEF03A447792F236D19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects DonutLoader 2 IoCs
resource yara_rule behavioral1/memory/5020-34-0x0000000000800000-0x0000000000844000-memory.dmp family_donutloader behavioral1/files/0x0007000000024555-33.dat family_donutloader - Detects ValleyRAT payload 2 IoCs
resource yara_rule behavioral1/memory/5020-35-0x0000000002700000-0x0000000002743000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4104-39-0x0000000001A30000-0x0000000001A73000-memory.dmp family_valleyrat_stage_2_v2 - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 21 5020 cmd.exe 22 4104 cmd.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 15 2868 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe - Executes dropped EXE 2 IoCs
pid Process 2848 pocket.exe 2300 pocket.exe - Loads dropped DLL 2 IoCs
pid Process 2848 pocket.exe 2300 pocket.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupApp = "C:\\Users\\Public\\Downloads\\pocket.exe" pocket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupApp = "C:\\Users\\Public\\Downloads\\pocket.exe" pocket.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: cmd.exe File opened (read-only) \??\S: cmd.exe File opened (read-only) \??\U: cmd.exe File opened (read-only) \??\Z: cmd.exe File opened (read-only) \??\T: cmd.exe File opened (read-only) \??\V: cmd.exe File opened (read-only) \??\W: cmd.exe File opened (read-only) \??\O: cmd.exe File opened (read-only) \??\V: cmd.exe File opened (read-only) \??\Z: cmd.exe File opened (read-only) \??\B: cmd.exe File opened (read-only) \??\H: cmd.exe File opened (read-only) \??\M: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\M: cmd.exe File opened (read-only) \??\R: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\G: cmd.exe File opened (read-only) \??\O: cmd.exe File opened (read-only) \??\H: cmd.exe File opened (read-only) \??\L: cmd.exe File opened (read-only) \??\T: cmd.exe File opened (read-only) \??\J: cmd.exe File opened (read-only) \??\L: cmd.exe File opened (read-only) \??\Q: cmd.exe File opened (read-only) \??\K: cmd.exe File opened (read-only) \??\N: cmd.exe File opened (read-only) \??\Q: cmd.exe File opened (read-only) \??\S: cmd.exe File opened (read-only) \??\X: cmd.exe File opened (read-only) \??\I: cmd.exe File opened (read-only) \??\N: cmd.exe File opened (read-only) \??\X: cmd.exe File opened (read-only) \??\I: cmd.exe File opened (read-only) \??\J: cmd.exe File opened (read-only) \??\U: cmd.exe File opened (read-only) \??\W: cmd.exe File opened (read-only) \??\P: cmd.exe File opened (read-only) \??\Y: cmd.exe File opened (read-only) \??\G: cmd.exe File opened (read-only) \??\P: cmd.exe File opened (read-only) \??\Y: cmd.exe File opened (read-only) \??\K: cmd.exe File opened (read-only) \??\R: cmd.exe - Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcrt.dll pocket.exe File opened for modification C:\Windows\SysWOW64\sechost.dll pocket.exe File opened for modification C:\Windows\SysWOW64\KERNELBASE.dll pocket.exe File opened for modification C:\Windows\SysWOW64\ADVAPI32.dll pocket.exe File opened for modification C:\Windows\SysWOW64\msvcrt.dll pocket.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll pocket.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll pocket.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL pocket.exe File opened for modification C:\Windows\SysWOW64\KERNELBASE.dll pocket.exe File opened for modification C:\Windows\SysWOW64\ADVAPI32.dll pocket.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll pocket.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll pocket.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL pocket.exe File opened for modification C:\Windows\SysWOW64\sechost.dll pocket.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 4520 2848 WerFault.exe 86 5104 2300 WerFault.exe 90 - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pocket.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pocket.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe 2868 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe 2848 pocket.exe 2848 pocket.exe 2300 pocket.exe 2300 pocket.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe 5020 cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5020 cmd.exe 4104 cmd.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2848 2868 2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe 86 PID 2848 wrote to memory of 5020 2848 pocket.exe 87 PID 2848 wrote to memory of 5020 2848 pocket.exe 87 PID 2300 wrote to memory of 4104 2300 pocket.exe 91 PID 2300 wrote to memory of 4104 2300 pocket.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3a7e81545b056d88ca351ea600a1f900_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Public\Downloads\pocket.exe"C:\Users\Public\Downloads\pocket.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd.exe3⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 2403⤵
- Program crash
PID:4520
-
-
-
C:\Users\Public\Downloads\pocket.exeC:\Users\Public\Downloads\pocket.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 2282⤵
- Program crash
PID:5104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2848 -ip 28481⤵PID:4380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2300 -ip 23001⤵PID:4720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Downloads\1.bin
- Size 270KB
- SHA256 409eb380119c7018ece4db5ab0fa60f1a21c0470081f577e956a3f1990dec211
- MD5 d5e0b5f1a079ca43044f3c05e1cb87be
- SHA1 36235739b1dae8d10ec11af4ca859e2c3c026f14
- SHA512 3c4396e00fd63f2a0a30ddbbb6809767519f27ea4788ce31ac9d102fbcfd58222e7ac4bca61259f83e01a798fc676077dab1344091725b33cd187b1a85c8752e
- SSDEEP 6144:9Htux5WEQVOGGTcYA0ajb3IgLreG24Jfg/+d/hJqNqoiQVrqm6ysB:htuxcEQVOTTczb4geNqg2BuqoZVWm6JB
- TLSH T13D4413939FB216D4DA222475FE08661EFB78348E022254CB770905C29E92E717F6D37E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Downloads\pocket.exe
- Size 649KB
- SHA256 cd3f8128fa0d1e7cf431f789da992c4a0844b8d928d51b2b24508fcf7fecdc80
- MD5 ac0cfc667a618edc62220de4ad261810
- SHA1 411f53091abba54b5c03fd425943c6b0727ea720
- SHA512 117dee966ea298ecbf6d3526eb6e7a47ba0d7d2743565d70fe2f3a5b532de469bec37a88dc8680360b7a84a2920579eb3d74a83d30412c9135ace90a63728fd2
- SSDEEP 12288:JXRcrW1UAHzssg4egsuG7FFkCIOBr260BKKPUCnb:JXqcKsgSNc2OHKMCb
- TLSH T146E48E89E6655987D3AA2F38D0A5F738533D6FF87C198543E4513BDABA36F832C62001
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Downloads\pocketBase.dll
- Size 178KB
- SHA256 356860433362f69f0a34526a7abd4e35dadc34f4285f57d0b084ca38c8234b1f
- MD5 53e58245086e31a122dc4f44f6c45cac
- SHA1 7e25a53f01c0c666249a483fb6d1599723dcaafe
- SHA512 d61e6ca768456c82ead96448ffad3784aace7da51a67062335e9435188422d36d4ee12198607b9b08646c734583356002fed52c4ad3cfb9b85f56b90fc4dedb8
- SSDEEP 3072:LvTmCzcn8YcgUioB07JP+UXgoWCYZAkhPPKOAg0Fuj0ZmkgFzXNjF:Lx9YcgUXB0NPlXO/AOTLxjF
- TLSH T1F4048E41B4C1C076D67F12390574DAB55B3EB9608EB5CEAF67D44E7F0F30280DA21AA6
- MD5 SHA1 SHA512 SSDEEP TLSH