ea155ccecd93166911b7c574dee9e8c2af62830c5d27ccb3546a4aa20f64c341

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_16b51e4ba256687c15c539ce3f89db7d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 2.4MB
Sample260808-2sefhaff95
SHA256 ea155ccecd93166911b7c574dee9e8c2af62830c5d27ccb3546a4aa20f64c341
MD5 16b51e4ba256687c15c539ce3f89db7d
SHA1 410da3f63623834cc3848e856c72651f8420a80d
SHA512 1f4a8d321cade3f8a7d8ee2464cdea6606f4c8930df318d1231e48541b98e639a9e14924cedf7d5ed1ef7ff80466bdbb3cbedea2548619206cfbfd521b49dea3
SSDEEP 49152:LRpOTuD1mLCcEUx6wsyQsik+gfl2zHBR0FRc1CNr9H5RZt:fDcz6xy1d2zHSc1CNZZRZ
TLSH
T13BC5BD03B390108FE0E1CFB07E5D579096D6781D5E21398A26C2BFD9A66337B59392CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PRO2198.tmp.png"	2026-08-08_16b51e4ba256687c15c539ce3f89db7d_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3288	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3288	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-08-08_16b51e4ba256687c15c539ce3f89db7d_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_16b51e4ba256687c15c539ce3f89db7d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Sets desktop wallpaper using registry
PID:3316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads