Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 22:34
General
- Target 2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 4.4MB
- Sample260804-2hdffssare
- SHA256 a6ba8ac6245ebec97acebebbf4d9dc930bb58342dafee3c4a8a648470ca4b26b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wininits.exe"C:\Users\Admin\AppData\Local\Temp\wininits.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Public\Documentsmz.txt" /B+"C:\Users\Public\Documentsmzy.jpg" /B C:\Users\Public\Documents\natqwjrg.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak && sc start "natqwjrg"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\sc.exesc start "natqwjrg"4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\梦醒时分-陈淑桦-1989一念间_电视原声带.mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Public\Documents\natqwjrg.exeC:\Users\Public\Documents\natqwjrg.exe -service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\natqwjrg.exe"C:\Users\Public\Documents\natqwjrg.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
wininits.exe
梦醒时分-陈淑桦-1989一念间_电视原声带.mp3
Documentsmz.txt
Documentsmzy.jpg
memory/4272-53-0x00007FFB673E0000-0x00007FFB67406000-memory.dmp
memory/4272-18-0x00007FFB5AB4D000-0x00007FFB5AB4F000-memory.dmp
memory/4272-454-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4272-37-0x00007FFB67C10000-0x00007FFB67C44000-memory.dmp
memory/4272-41-0x00007FFB67F30000-0x00007FFB67F52000-memory.dmp
memory/4272-42-0x00007FFB67910000-0x00007FFB6793B000-memory.dmp
memory/4272-40-0x00007FFB6CB30000-0x00007FFB6CB49000-memory.dmp
memory/4272-39-0x00007FFB71890000-0x00007FFB718A1000-memory.dmp
memory/4272-38-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4272-43-0x00007FFB5A320000-0x00007FFB5A6B0000-memory.dmp
memory/4272-46-0x00007FFB67830000-0x00007FFB67902000-memory.dmp
memory/4272-48-0x00007FFB67660000-0x00007FFB67748000-memory.dmp
memory/4272-57-0x00007FFB67350000-0x00007FFB67361000-memory.dmp
memory/4272-56-0x00007FFB67370000-0x00007FFB67381000-memory.dmp
memory/4272-55-0x00007FFB67390000-0x00007FFB673AA000-memory.dmp
memory/4272-54-0x00007FFB673B0000-0x00007FFB673DD000-memory.dmp
memory/4272-50-0x00007FFB67520000-0x00007FFB67561000-memory.dmp
memory/4272-52-0x00007FFB67A60000-0x00007FFB67A78000-memory.dmp
memory/4272-19-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4272-51-0x00007FFB674F0000-0x00007FFB6751F000-memory.dmp
memory/4272-44-0x00007FFB6C870000-0x00007FFB6C884000-memory.dmp
memory/4272-47-0x00007FFB5A080000-0x00007FFB5A316000-memory.dmp
memory/4272-45-0x00007FFB67F10000-0x00007FFB67F21000-memory.dmp
memory/4272-49-0x00007FFB67570000-0x00007FFB67653000-memory.dmp
memory/4272-36-0x00007FF64DE10000-0x00007FF64DF08000-memory.dmp
memory/4272-63-0x00007FFB67030000-0x00007FFB6704B000-memory.dmp
memory/4272-62-0x00007FFB59F30000-0x00007FFB59FDB000-memory.dmp
memory/4272-64-0x00007FFB66E50000-0x00007FFB66E62000-memory.dmp
memory/4272-61-0x00007FFB672D0000-0x00007FFB672F5000-memory.dmp
memory/4272-60-0x00007FFB67300000-0x00007FFB6734F000-memory.dmp
memory/4272-59-0x00007FFB59FE0000-0x00007FFB5A078000-memory.dmp
memory/4272-58-0x00007FFB5AB70000-0x00007FFB5AD7B000-memory.dmp
memory/4272-65-0x000001C353E30000-0x000001C3542EA000-memory.dmp
memory/4272-66-0x00007FFB53F60000-0x00007FFB541A5000-memory.dmp
memory/4272-67-0x000001C3546F0000-0x000001C354870000-memory.dmp
memory/4272-102-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4272-262-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4272-326-0x00007FFB5A8A0000-0x00007FFB5AB56000-memory.dmp
memory/4348-30-0x0000000000B60000-0x0000000000B61000-memory.dmp