Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 1.3MB
- Sample260803-m2a24shj21
- SHA256 b2477fbee1a359069f59ebf1357d8f84c9fef74069a5553b3e223438e5ca1a49
- MD5 d87002ff04bf4bb84336948add3bedd1
- SHA1 ca6abd1175b9b05e56445d7b91b8c58ec4060bc1
- SHA512 9591b047c76350791a036d1a03426650a64db31c274b984c22e69e8b3a66a818563e4b7e6bc21dfe4323ba723348f515acaa93f995aaaf4960113c7c073a0511
- SSDEEP 24576:muYVy+rJjU/+IWc9AhyaLrJ7RM2DYPdAMG+0r5g5KZiAynK:wy+rFUWpq2yoRM3PdsR0lnK
- TLSH T10855AF41E3B801E8C26F8278C6469A0BEB72780513205BDB57E45B6A3F63BE15F7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5888 2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5888 2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5888 2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5888 2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5888