Analysis
- max time kernel
39s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 19:51
General
- Target 2026-08-07_7bf3d2a75f5ab8864c2449ed1611c88a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
- Size 56.5MB
- Sample260807-yk84csvyfv
- SHA256 63a5b67df30258e68d354ae0dfaa85db5daef927ba7b86db50527e8fcd70b6e9
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 2 IoCs
- Outbound SSH connection to public host 2 TTPs 6 IoCs
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 8 IoCs
Inno Setup installer
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_7bf3d2a75f5ab8864c2449ed1611c88a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7bf3d2a75f5ab8864c2449ed1611c88a_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\1.exe"C:\Program Files (x86)\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EM4L5.tmp\1.tmp"C:\Users\Admin\AppData\Local\Temp\is-EM4L5.tmp\1.tmp" /SL5="$60272,17057206,825856,C:\Program Files (x86)\1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Local\assembly\dl3\W686LE\M8qy3\uEp5D\8gPMF.exe"C:\Users\Admin\AppData\Local\Local\assembly\dl3\W686LE\M8qy3\uEp5D\8gPMF.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\SafeW.exe"C:\Program Files (x86)\SafeW.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BC81I.tmp\SafeW.tmp"C:\Users\Admin\AppData\Local\Temp\is-BC81I.tmp\SafeW.tmp" /SL5="$500FC,40811281,1025024,C:\Program Files (x86)\SafeW.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.exe
SafeW.exe
8gPMF.exe
UFts.Cv4
WjJK.6
SafeW.tmp
1.tmp
memory/1316-14-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/1316-45-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/1316-14-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/1316-45-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/1624-66-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-72-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-71-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-71-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-73-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-72-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-70-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-66-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-64-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-73-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-64-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/1624-70-0x000001EB73360000-0x000001EB7593E000-memory.dmp
memory/3140-48-0x0000000000340000-0x0000000000448000-memory.dmp
memory/3140-48-0x0000000000340000-0x0000000000448000-memory.dmp
memory/3140-29-0x0000000000340000-0x0000000000448000-memory.dmp
memory/3140-29-0x0000000000340000-0x0000000000448000-memory.dmp
memory/4208-44-0x0000000000400000-0x00000000006F9000-memory.dmp
memory/4208-44-0x0000000000400000-0x00000000006F9000-memory.dmp
memory/4208-21-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4208-21-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/5336-59-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-60-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-51-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-51-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-54-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-54-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-58-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-59-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-61-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-58-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-61-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5336-60-0x0000023817D80000-0x000002381A35E000-memory.dmp
memory/5740-63-0x00000000008E0000-0x0000000000C47000-memory.dmp
memory/5740-49-0x00000000008E0000-0x0000000000C47000-memory.dmp
memory/5740-49-0x00000000008E0000-0x0000000000C47000-memory.dmp
memory/5740-63-0x00000000008E0000-0x0000000000C47000-memory.dmp