a05965ebf065865a684ef901d52ec6b9372b33b5bfac6d94ce22017d4ea848de

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8386f7de55619e3ac3c0383489a7ff66_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 419KB
Sample260802-ka2pmsydma
SHA256 a05965ebf065865a684ef901d52ec6b9372b33b5bfac6d94ce22017d4ea848de
MD5 8386f7de55619e3ac3c0383489a7ff66
SHA1 5e3b119c9ebd3ae4c78e89039288882f9ed24edb
SHA512 60b5987de5ffd6a965063321953c5f3104daf61485e9639dc3e23ad9e4ecf5524d9cec6002862a8f95e6f5415ec0b9833fc736ffb0e61df54f37536e860b4f0d
SSDEEP 6144:UsCaiICo9CsJQpCYhZcu9m0rarKPyLW1NQN9:UV/tsWpCKZbEM2n
TLSH
T12D94084AEAA510F1D1BBC03CC592651AFD7138AA4370EBCB57985A571F23BE4E93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion spyware trojan

Malware Config

Signatures

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AF3C79A5A38B6D5A5532BD88477D99A1DF0744E5\Blob = 030000000100000014000000af3c79a5a38b6d5a5532bd88477d99a1df0744e50200000001000000a40000001c0000004c00000001000000000000000000000000000000010000005300740069006e006b00790045006d00750043007000700043006f006e007400610069006e00650072000000000000004d006900630072006f0073006f0066007400200042006100730065002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000002000000001000000e0020000308202dc308201c4a0030201020210606ef26b9ed706864ec31a2e2c8500dd300d06092a864886f70d0101050500302a312830260603550403131f7374696e6b792d617574682e736372757a79742e776f726b6572732e646576301e170d3236303830323038323434355a170d3237303830323134323434355a302a312830260603550403131f7374696e6b792d617574682e736372757a79742e776f726b6572732e64657630820122300d06092a864886f70d01010105000382010f003082010a0282010100e382cc50f8bef7296b35735048a20b7c87435a37ece40a5611274151c60deb890dd8d4046ad24b012b75ef50dcc3bb374618ec6e6ae28b321a873f0b7bf54923977e51dd8923d215beae7ee595a47fdd95d286b2687c4e021fd523331ad8fd28afd2380e8434335a843d584b272303e5f318d6a13c7ab321faad20aa4f8e78970dfb9d10ec4d96a6493096b3498f003d06ffca33723a92d4269432969c4c805cf5e83fb161f2eb5443a80ffee139beda2a8043a361c77fe2e8ea70b6d00794303af247e7b50d5e0f5a84faa45753d41ab532246b50443ad2693c948b32c2cf79e705ebfb929478818382fb870aed17391dde6234aeb52fc03606cb99907f7e410203010001300d06092a864886f70d010105050003820101007f1f3c1e83b691e8d44b0f8cc94dc503c01bb181fa161b0251061cddc8783c4d735feec3a4a13425a4fab5207a85e85c6e5aab28ad7d488086986e269f4b52eb6a47d29c5424c9696a229ff8e7cb889685694ece34fbbe5d8e2495704f921898e67674211d3a35c79478eb0809d5d87c5f0fcbad8a2b98723d246c7f6b09fe33b80420c72bfbfe41fce52ec7fc51371429614fdfbbe3f94ffdd8b413684f31791c42e99657441f56df3acc88507853c0cddf7f59149b3d8985b8117bd8bbce117f23ec2922780ae80e84bb6466d56cb930b632dd2ec3c309101e4b3f302e839948390133e853139b87d1b12f514c92c9882be9cb9ad9e9d71924f1bb1904c3a7	2026-08-02_8386f7de55619e3ac3c0383489a7ff66_cobalt-strike_icedid_njrat_satacom_stealc.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AF3C79A5A38B6D5A5532BD88477D99A1DF0744E5	2026-08-02_8386f7de55619e3ac3c0383489a7ff66_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8386f7de55619e3ac3c0383489a7ff66_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8386f7de55619e3ac3c0383489a7ff66_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads