Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 268KB
- Sample260802-mk49ma1bja
- SHA256 f0e70c9e9169e8df4be60e24a2dad319b58d7d97a01868f9c5da7b3bd230583c
- MD5 e74692578127715c5e1fa0f4978dcc8c
- SHA1 08c579a2b5c3162c98aecbc4965c63d89e83ae57
- SHA512 3a67763843cab85ff949632e73739ad037cba2485c9ef0bfee0d77cf1fc0859f2eb2c0e0338c791dfc86c35b1278159fa6e9f53ea186864a33bac46f08403481
- SSDEEP 6144:zbcvLL+JL3n6Gsri+NIOuXtaIe20ezxy/:zbrrnJsriJO0aIm
- TLSH T16B447D15B7A50CF9ED67867DCC425906EA72BC174760E78F03A04A971F236E09E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..-interface-remoting_31bf3856ad364e35_10.0.26100.1_none_6647ffc12e9f7d9a.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-b..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_en-us_56e8b0050991733d.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-wwfcorecomp.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_e7274599475b7e6a.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_usb4devicerouter.inf.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_01ea7a77dee5178c.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\Cortana.UI\cache\SVLocal\DesktopDefault\2.html.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_c_diskdrive.inf-languagepack_31bf3856ad364e35_10.0.26100.1_it-it_98794315b188c0c3.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..equired-deployment0_31bf3856ad364e35_10.0.26100.1591_none_158983c2a3799fb6.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..ation-mediatypeinfo_31bf3856ad364e35_10.0.26100.1_none_34934f24e622f7c7.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_uk-ua_0019dcf67042b94d.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\msil_microsoft.tpm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_67745508d8e3bb05.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_storage_fcdb4bda9a6da24d.cdf-ms.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_d5a1044708606755_appidsvc.dll.mui_6717e231.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-win32kbase.resources_31bf3856ad364e35_10.0.26100.1000_en-us_bcabba1f29cca8d5_win32kbase.sys.mui_07d441e9.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-onecore-c..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_fr-fr_208b1f003f719c82.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.26100.1_en-us_bfa9ca6fac1b0cfc.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_xinputhid.inf.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_de31d60cc13433e5\xinputhid.inf_loc.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\System Information.lnk.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-inkfree_31bf3856ad364e35_10.0.26100.1_none_0fd4711f6ed228e4\Inkfree.ttf.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-lmprofile_31bf3856ad364e35_10.0.26100.1455_none_ee7b466f3b396790\r\IMJPLMP.DLL.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_6e4b20249544283de445636977e6c416_b03f5f7f11d50a3a_10.0.27000.313_none_adf8788dda824b3f.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..rpipeline.resources_31bf3856ad364e35_10.0.26100.1_en-us_f4e51b0f63831369.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tomanager.resources_31bf3856ad364e35_10.0.26100.1_de-de_316f4be59de5457d\PlayToManager.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ntmanifests-termsrv_31bf3856ad364e35_10.0.26100.1150_none_c10a6c2821777ad4\TerminalServices-AppServer-Licensing-replacement.man.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..c-runtime.resources_31bf3856ad364e35_10.0.26100.1_en-us_f6c8143bb67395d0.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-r..facturers.resources_31bf3856ad364e35_10.0.26100.1_es-es_d1f10d61b6e50b53.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\FileMaps\$$_systemapps_microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe_23_common_monaco-editor_min_836d0bedf622f96e.cdf-ms.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Catalogs\caaaa1d0bda1c3b0f4a31a1a088a2f74f16677de3d4f788caedc36c8e5aaff1e.cat.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-fileexp_31bf3856ad364e35_10.0.26100.1591_none_ed01032043c8051c\FileExp\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\windows.iconsize.large.svg.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\StartMenu\Assets\FileIcons\32\code.svg.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.26100.1_en-us_c93621b935b09922\tcpipcfg.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..itomi-dll.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_058e069c0a9baded\wmitomi.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_c_smartcardreader.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_709e84f51e364104.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-i..httpcache.resources_31bf3856ad364e35_10.0.26100.1_en-us_45220051670f5e2f.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\FileMaps\$$_waas_regkeys_dbffc348a6fab71c.cdf-ms.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netl1e64.inf.resources_31bf3856ad364e35_10.0.26100.1_it-it_81e7a51b1519718a\netl1e64.inf_loc.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netutils_31bf3856ad364e35_10.0.26100.1_none_37616051e706407a\netutils.dll.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-g..broker-capabilities_31bf3856ad364e35_10.0.26100.1_none_d69e074049386499.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.26100.1591_km-kh_21fb71f5c2545c3e.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-msvideodsp_31bf3856ad364e35_10.0.26100.1_none_d6d881233a9c61c6.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\x86_microsoft-windows-d..input-cpl.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_0269582437e6a834.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.26100.1_et-ee_3da0c0e2cb79d1b5_msimsg.dll.mui_72e8994f.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\Cortana.UI\Assets\store.contrast-black.png.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ileserver.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_413de8b55e74dac3\wsp_fs_uninstall.mfl.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-internal-ui-dialogs_31bf3856ad364e35_10.0.26100.1591_none_5fca85d95db11c1b\r\Windows.Internal.UI.Dialogs.dll.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\msil_system.security.resources_b03f5f7f11d50a3a_10.0.26100.1_ja-jp_074f7964b3da57a4\System.Security.Resources.dll.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-w..onservice.resources_31bf3856ad364e35_10.0.26100.1_es-es_94669162cf03a19f.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.26100.1591_mr-in_fc39013151632ffa.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_10.0.26100.1_es-es_1200e9448ab8c2fa\sens.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_bf8b51805a8ca15b\findstr.exe.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_windows-defender-service.resources_31bf3856ad364e35_10.0.26100.1_es-es_76d0fdf6a40d4d62\MpAsDesc.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-telephony-phoneutil_31bf3856ad364e35_10.0.26100.1_none_e86e912d7f4a0ddd\PhoneutilRes.dll.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_uk-ua_c8d4e8e75f181c2e.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\FileMaps\$$_syswow64_fi-fi_a03dd00274bf8757.cdf-ms.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_af34e47874e194e7\DiagPackage.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llers-onecore-extra_31bf3856ad364e35_10.0.26100.1_none_20ce6b8e2bc58542\msdtcadvancedinstaller.dll.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_57a012d4f9a10c42\RS_ResetIdleDiskTimeout.psd1.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-datacenterbridging_31bf3856ad364e35_10.0.26100.1_none_d486f7172c157e1b\MSFT_NetQosFlowControl.cdxml.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..lekanjifinderapplet_31bf3856ad364e35_10.0.26100.1591_none_88c8473e2d36bd34\IMJPSKF.DLL.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..quota-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_9a4375a132895ba6.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_b3f6b9b29afd1979.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-netplwiz-exe.resources_31bf3856ad364e35_10.0.26100.1_it-it_87b9009047b766d9.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\Manifests\amd64_microsoft.transactions.bridge.resources_b03f5f7f11d50a3a_4.0.15912.0_ja-jp_a2d1f8f1e151d64f.manifest.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine.resources_31bf3856ad364e35_7.0.26100.1455_en-us_4bd9435d002eb378\mssvp.dll.mui.crypt 2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in Windows directory
PID:3416