8c9f001753929590128ab112232a85bdc4c1d74bbc621eced194f14268788b4d

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:14

Target
2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 365KB
Sample260804-fxbdragl3v
SHA256 8c9f001753929590128ab112232a85bdc4c1d74bbc621eced194f14268788b4d
MD5 dbcbccbd0201abcf7572c5c49d34c537
SHA1 474e09157262994297a18353e1c9b7ab034b1c82
SHA512 1a319e2d63d5c81ea1f84df75ea0d582716930dd3adf200b34914648188a4e403411460df3b42da9e57f4017fffe0483732f8e597382d0379f9c814724a6c518
SSDEEP 3072:lgGJ3v67Gie2MN/ZMu8XsfPqgFu9f8yssmJkC2863kachDFzy1i6QR1qz0O0Gawn:4cDsmJkC2863kaQD6dzIGaz3Ii336
TLSH
T1A4845C4AEBA510F5E5BBC178C952561BFD717CA24370A78F63904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1800 created 1812	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2040	sc.exe
3544	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4844	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4844	1800	2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 4844 wrote to memory of 2040	4844	cmd.exe	94
PID 4844 wrote to memory of 3544	4844	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\winver.exe
  C:\Windows\system32\winver.exe
  2⤵
  PID:2944
- C:\Windows\system32\ComputerDefaults.exe
  C:\Windows\system32\ComputerDefaults.exe
  2⤵
  PID:1812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel & sc start moimoi
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\system32\sc.exe
      sc create moimoi binPath= C:\Users\Public\moimoi.sys type= kernel
      4⤵
      Launches sc.exe
      PID:2040
  - - C:\Windows\system32\sc.exe
      sc start moimoi
      4⤵
      Launches sc.exe
      PID:3544