dc8083e26727bd1252dc1fb91e7891cce79c7513711d3c513749e2bcff970fc4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_d59c43de501babd3adc214fb690ca87b_cobalt-strike_icedid_njrat_satacom.exe
Size 172KB
Sample260805-b6s8pswarb
SHA256 dc8083e26727bd1252dc1fb91e7891cce79c7513711d3c513749e2bcff970fc4
MD5 d59c43de501babd3adc214fb690ca87b
SHA1 dca674289f9b5da54918c7c188cf8a67a018ef44
SHA512 29e41c4f393268a047e9bdc205a38f5bcbe748901c03ba48c126e5406241cf6b7b59eecba17abd182c2f049f77f9332992f53024b74ade0cd4ec5c7b1f7ae98c
SSDEEP 3072:U/9kW26ll/EeS6Wuvb+gPkPoZMDKKOGtJwpLbWyDVN4qOc8HN:cTcF2bX1aJw9bVh58HN
TLSH
T1FE048D56B7D511F5E173813CC9A04642EB72782607319BEF03A44776AF236E1AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5068	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3888	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	powershell.exe
5068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3888	4560	2026-08-05_d59c43de501babd3adc214fb690ca87b_cobalt-strike_icedid_njrat_satacom.exe	86
PID 3888 wrote to memory of 5068	3888	cmd.exe	87
PID 4560 wrote to memory of 416	4560	2026-08-05_d59c43de501babd3adc214fb690ca87b_cobalt-strike_icedid_njrat_satacom.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-05_d59c43de501babd3adc214fb690ca87b_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_d59c43de501babd3adc214fb690ca87b_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\files_for_zip\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\collected_files.zip' -Force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\files_for_zip\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\collected_files.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\files_for_zip"
  2⤵
  PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_od4ur4xn.pmi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_od4ur4xn.pmi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

collected_files.zip

Path C:\Users\Admin\AppData\Local\Temp\collected_files.zip
Size 2.2MB
SHA256 68ada042d045f556e24985840e008586ac0771d3fd3e59c9035e8260b925392c
MD5 309f5076a9c687d9abe0d483200bd1f6
SHA1 4cc2f7ea4284d4841ac3de59b6a5c725fbf60130
SHA512 7a6661b5324929535c6eabda6dcac2e87768b9f0cab0e827ca0dd92b37363e6d280f7355b72bff73160e86a0e66bdbb58b23ebc451db815d0b9d1007ee501929
SSDEEP 49152:abRU6oeJG6MGAGHPF4ws5ntMKN7GXReoveXnjlp04YTx+L1EhXi4:a9aR9aHd7QtBUXwovAnRLH1CX5
TLSH
T1F7B5334FDB8BA365CB45CCC4F95CB4020EB885FBB4B9941EE35AB832D06D9406FB1529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountSend.docx

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\DismountSend.docx
Size 347KB
SHA256 ac130a50b1989dbdb2908f88c034c2fcb34cbae68a0a3814f7b0190a894277d6
MD5 c964b09ec452dc1b629ff1f608b001b0
SHA1 3bd23ca4da29eaccff51e4192a48e91d4a4d7c06
SHA512 6a9a6afc04ffe63519ba065847f2a7a6a186bb26a6d2f37b6d027dc7e3a9bf7efa7b627b1ee5afa7763a48571daf1632dc810be7acab201326d955a8c71ad9d4
SSDEEP 6144:Hvi5pwifj7mGJwGEAkazClgVTEykh/i/WuYyFEXglitx8UzxxgbNOfp/:CpwumGJ5EbZlgCy6G1k/VxgxOJ
TLSH
T16574232F8A3FF717D32C9480B91825415FA9C97E38D1AC0C3B66B35BB135668DAE0499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindSuspend.jpg

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\FindSuspend.jpg
Size 277KB
SHA256 b9995a47251342c4f24b09236a7c6e1d95d580cd169e14c864364fc0f6ff87f7
MD5 ed333aebde1b9580f2ec136a594ac310
SHA1 941159986944655c74c1c5cf24977def201bb176
SHA512 71e68d4bf64b94739f7cfbb6aa915f0a5962187019ceae638d0d3a0fb6bf1baf43d0c0cef797e56991e0af1105243a32ddc02add5158d91a22f9b899bb4c9397
SSDEEP 6144:O7MCJXywfhTmjowyCtDWAs+spaGAKz7EAlnc+Y7RU1r9HF:p4yohi3HWD8Kz7E8kupHF
TLSH
T1C354233B5E0122925BD39D9E2876DD1C043F55BAB56E005D824FAC31C9EF8A076B262F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallUnpublish.jpg

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\InstallUnpublish.jpg
Size 526KB
SHA256 532cb313166ab153791c95a3e86da82f3ce9d0750adff9c055240a163e6f03d8
MD5 c2bd07152ef16663ac5f5c3e76fa1feb
SHA1 ee22031f416b657c008c4af637a0f0fb363b6291
SHA512 4471a549e75429c89f34f719d058eac806c8b19b160b16fa15e58a980b379d97d5a4c53fcdfdf93a60c1487fd12eceb4dddccea4feb92b05febe9f669b85b678
SSDEEP 12288:8M4SG/8kasJioFUGdn88fyRdksVnMxpwn/5tB6t4S:8M4SGVNUGdy4sVnTfB6t4S
TLSH
T16EB423879EC203E40D95CCA2EEC4E0130FE912ABF9FB640BCA5BA571645AF4449BF15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutRestart.jpg

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\OutRestart.jpg
Size 629KB
SHA256 1a14665f9f9df87e1fc0b909c7ab5a71c859950f16d867bfad2555e7362895ac
MD5 56638687b767baa5d52c6a76b0be9c4d
SHA1 5a5920a4560c9c58fda2009126f738907399dedf
SHA512 8267a3d0567e7b2576ca3efd7f481c8d2b5f2245e333f73380f0e5c474ad67f2bfaf61618c2b9740a754ee31d37d7bf5a08d9b57eb07c66f40ebf42a10611c5f
SSDEEP 12288:vac9UgUjZUCSYQnBIGXd5ndKN2Qehv7i396sk1cozkpZ2zafv4FeCeeLk7C7:iRxKBIGXzdKcvO3L5Zj0e+k+7
TLSH
T18CD423C7E39FBE69C619599CBA3C6045BE712CE672ACD6BF9790243EED050209F81C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishLock.docx

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\PublishLock.docx
Size 454KB
SHA256 f659105e32ebf4f94034960f8ca6da4804ab7a7757100e76fb9a0cebb3d4559a
MD5 626ca930adde359eb1a22402c3bd4cd1
SHA1 39a70015bad8c0ad3ed7a4f7493d3c0ea309349c
SHA512 0db6b8e17b3ed1f04519e49afd4f103db3fd02a620d619a424e4f395142c832df85f6dddf665ee704d8e2e2ac8830e56d1f766a0f63b58cc33849ead8ca1c555
SSDEEP 12288:Wq/03dXpxik0msoJps3ncqE2tTsMW7xNv:Wq/SdXpB02EBE2FnW95
TLSH
T1B7A4238CEE91E357DA4AE5C8F0C6346368A8D7D2B836901DB11DEE8602DC8497E71372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUninstall.docx

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\SetUninstall.docx
Size 14KB
SHA256 f08fa758254cc5b77a561bc15248ade988d2de3221f91c2d9587ee29ea9899f7
MD5 b612f68f6e7e5727d83e0f14662d9f8a
SHA1 b692ba575e52f25f14272a60fcff9360b54f6c00
SHA512 c1966509bfe07ea3b4c02a98503aae38acf65e41ae80d16b45620f894d77f6d9c2a2d8164f8ae6608081c00de7b7544df38299a59867540d0a933850b933a482
SSDEEP 192:CtxWdAe3RI3aPgzK/3OvmJMhCCNxtpgoZ22NNG38meTWNGFHBEhZ6xJF:axWD3eMgO/+uCdNxt/ZtNNkrIFHKZQJF
TLSH
T15D62B038D60648B2F9238A38B09D03F1E53D52827509E45B34DB7E5DC387B961767D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockExit.docx

Path C:\Users\Admin\AppData\Local\Temp\files_for_zip\UnlockExit.docx
Size 16KB
SHA256 71780125b375133d2aaae887f740c0d201a8acb1b4933570b4fd22cb6a8027b2
MD5 84fc4e012edee09f812dbea74ab0101c
SHA1 edf1f8f831e5339fc02d1cf63a423fc30402111c
SHA512 f4d492683ba94d0edfac91f5a6875e7a0c56c5a36d1b63e123311f7cfda7a0e60b4a3a046722184a7e2f352fdc245fd3c318ed7f86d7448dc31498cd01873c1b
SSDEEP 384:aByoGaFolqsLldNxt/ZtNNPjWIFHK6yaeOpp:WqeS9LlxllNqItVeOX
TLSH
T17572C079D7076934E4E34E3C605D03F5E51D46027E89A18B208EF2DEC29BB85130B79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4560-0-0x00007FF6CCE40000-0x00007FF6CCE6F000-memory.dmp

Download

memory/5068-20-0x000001F9ECE60000-0x000001F9ECE6A000-memory.dmp

Download

memory/5068-19-0x000001F9ECE80000-0x000001F9ECE92000-memory.dmp

Download

memory/5068-18-0x000001F9EC080000-0x000001F9EC090000-memory.dmp

Download

memory/5068-8-0x000001F9EC080000-0x000001F9EC090000-memory.dmp

Download

memory/5068-10-0x000001F9EC9B0000-0x000001F9EC9D2000-memory.dmp

Download

memory/5068-9-0x000001F9EC080000-0x000001F9EC090000-memory.dmp

Download