Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 946KB
- Sample260803-vcdeyawsbt
- SHA256 0a460a14cb9a6724d8e88b6bf7b256f436620c2d4ae2e0a6fad3416cb3bcbe13
- MD5 d264738640f8c1592710c9e3a08c79cc
- SHA1 62050e51300e8843da645b963321669c626e2aea
- SHA512 e306aee3346d3f684c5fc84b99ff94300fd5dc588a0904eb8ae4044c16e9fd4e2d7ff345ad8d1c003ea0acf183a05b846ea3cfd06f9cf20e323abdbf7d776d97
- SSDEEP 12288:SUSBkC2q9qO1xfUx+irmmHC+uSv7mBBtSnVFIYSZkTtgr+iCznAoUMrNGe:hC2q9qsUZmmHMw7G2VFIYSZMisnAsGe
- TLSH T17B25A055E2E401F8E17BD674C9B2A61BDA36785617309ACF03D0056D3F336E44ABBB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 4712 powershell.exe 4864 powershell.exe 2812 powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 powershell.exe 4864 powershell.exe 2812 powershell.exe 2812 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 powershell.exe Token: SeIncreaseQuotaPrivilege 4864 powershell.exe Token: SeSecurityPrivilege 4864 powershell.exe Token: SeTakeOwnershipPrivilege 4864 powershell.exe Token: SeLoadDriverPrivilege 4864 powershell.exe Token: SeSystemProfilePrivilege 4864 powershell.exe Token: SeSystemtimePrivilege 4864 powershell.exe Token: SeProfSingleProcessPrivilege 4864 powershell.exe Token: SeIncBasePriorityPrivilege 4864 powershell.exe Token: SeCreatePagefilePrivilege 4864 powershell.exe Token: SeBackupPrivilege 4864 powershell.exe Token: SeRestorePrivilege 4864 powershell.exe Token: SeShutdownPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeSystemEnvironmentPrivilege 4864 powershell.exe Token: SeRemoteShutdownPrivilege 4864 powershell.exe Token: SeUndockPrivilege 4864 powershell.exe Token: SeManageVolumePrivilege 4864 powershell.exe Token: 33 4864 powershell.exe Token: 34 4864 powershell.exe Token: 35 4864 powershell.exe Token: 36 4864 powershell.exe Token: SeIncreaseQuotaPrivilege 4864 powershell.exe Token: SeSecurityPrivilege 4864 powershell.exe Token: SeTakeOwnershipPrivilege 4864 powershell.exe Token: SeLoadDriverPrivilege 4864 powershell.exe Token: SeSystemProfilePrivilege 4864 powershell.exe Token: SeSystemtimePrivilege 4864 powershell.exe Token: SeProfSingleProcessPrivilege 4864 powershell.exe Token: SeIncBasePriorityPrivilege 4864 powershell.exe Token: SeCreatePagefilePrivilege 4864 powershell.exe Token: SeBackupPrivilege 4864 powershell.exe Token: SeRestorePrivilege 4864 powershell.exe Token: SeShutdownPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeSystemEnvironmentPrivilege 4864 powershell.exe Token: SeRemoteShutdownPrivilege 4864 powershell.exe Token: SeUndockPrivilege 4864 powershell.exe Token: SeManageVolumePrivilege 4864 powershell.exe Token: 33 4864 powershell.exe Token: 34 4864 powershell.exe Token: 35 4864 powershell.exe Token: 36 4864 powershell.exe Token: SeIncreaseQuotaPrivilege 4864 powershell.exe Token: SeSecurityPrivilege 4864 powershell.exe Token: SeTakeOwnershipPrivilege 4864 powershell.exe Token: SeLoadDriverPrivilege 4864 powershell.exe Token: SeSystemProfilePrivilege 4864 powershell.exe Token: SeSystemtimePrivilege 4864 powershell.exe Token: SeProfSingleProcessPrivilege 4864 powershell.exe Token: SeIncBasePriorityPrivilege 4864 powershell.exe Token: SeCreatePagefilePrivilege 4864 powershell.exe Token: SeBackupPrivilege 4864 powershell.exe Token: SeRestorePrivilege 4864 powershell.exe Token: SeShutdownPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeSystemEnvironmentPrivilege 4864 powershell.exe Token: SeRemoteShutdownPrivilege 4864 powershell.exe Token: SeUndockPrivilege 4864 powershell.exe Token: SeManageVolumePrivilege 4864 powershell.exe Token: 33 4864 powershell.exe Token: 34 4864 powershell.exe Token: 35 4864 powershell.exe Token: 36 4864 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2032 wrote to memory of 4864 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe 89 PID 2032 wrote to memory of 2812 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe 92 PID 2032 wrote to memory of 4712 2032 2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\GModCacheUnlock\Install-Watcher.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\GModCacheUnlock\Unlock-MapPack.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\GModCacheUnlock\Watch-GModCache.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4712
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\GModCacheUnlock\Install-Watcher.ps1
- Size 1KB
- SHA256 1f72564eff8630149e35414a3a66798f1c96eda24df0459171f77d48c4523496
- MD5 91c8c3f5e35746a087b913272089c89a
- SHA1 626d91a38588a7d1039fd6476fde345e910b50f8
- SHA512 54e78db396164e848cf7f22cbe8a9a37b27b790a1aebee0b4199b7dcb18a05a1a16fe02ecb40b3869412b35f7c40a3d7a4f57802ef007e68b864a07bfeb60907
- TLSH T1D521B139B921B0095D8E062DCACA57A06C36103ED122B82BA5EB84945F494EEDB52465
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GModCacheUnlock\Unlock-MapPack.ps1
- Size 1KB
- SHA256 d7f1a588ddd4893d7f6ac1ee6b0ed6c822ffec3517b5e9e53f977185f6d5c99c
- MD5 8dea314fbc787c12d780be7bf8043ab7
- SHA1 794d9b7be205ff6679062ef53e1f56a8aa89835f
- SHA512 fb7d1465f9bc03f460e9e6d5785a8b473800d623d224f3e5c0513114d3efeb0e7d16f6b74846f30d0eb9389be1b282e1b7f43bd929cfd64de7a495ed504f1cac
- TLSH T16D31CC4C6B20186013A30B642DE63DA8D918489F8D7D3B01753ECE461F525A8CE623DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GModCacheUnlock\Watch-GModCache.ps1
- Size 2KB
- SHA256 9a803b852c0f06239c1e5ef98d4cb4304422bed1aebedd155bb987945693c97f
- MD5 42126d3e1cad0e235e1d113cfdfe04d4
- SHA1 18cc5eb7208851cb83114ccdd66fb4bf4e30fbed
- SHA512 59d3827f7a5104663f0b7837fdff4089b71688e7a87a39f2c536d34c13454c9a7d56b2ab72b4191769d6050bb136f12e3f2e360af9620711ad4d1a96d990dc24
- TLSH T17541AA306AF0B04150C79B7F5DEBB1159D3909FBD1052604B12E9A885F1F924CF59FD5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5dec38f5b26be6af1f40a1a8c5339ca22f23022326b1a7826a5192d2f619e6db
- MD5 096616706cd53ce7648435c8fc2a21ed
- SHA1 a8430440322d7236cba82fc481b9769d44d18ae6
- SHA512 49b777b81f04235bcac36300bd806cbdb6e5e3b958d503e56f76b778ba5758f5542561c73627283ca6359ee210ac3cbf09fdd78b230e5e8acd47b5d7337ff4ae
- TLSH T12B219833B3CC8614CC9A013A10CDAC1036B6C7CB40DECFAB7B84E155A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 21d7a886b80d7b6176910c55e5c6f525b2a1eb7159d358d3a54fdfa3c9fc43c2
- MD5 da7199694a0acd04a7bec13dce03042c
- SHA1 a8ce5d0d8d39791cf4c95e154bf8c96f3374e3bc
- SHA512 b69b8348ed85814c5dd96b763240e86a1b41b3d11e7d123f0f96b1b8276c114a4e404d0b62a03ed99753045752c08d2b8c37fd3e628ca63d05109184b2813b75
- TLSH T16E115733F3CC8724C89A403650CEAC1036B587DB509ECE6BBB84D154B43F5A9CE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eskgombw.blj.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH