fabb78ffdae34dbdaa6f1c66cfceada74618fdfdd94c0d311523a07af1a4f9bb

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f951c6c7352b7fabe6cf41e3c90a82a7_cobalt-strike_icedid_njrat_satacom.exe
Size 310KB
Sample260808-pwdl6ade63
SHA256 fabb78ffdae34dbdaa6f1c66cfceada74618fdfdd94c0d311523a07af1a4f9bb
MD5 f951c6c7352b7fabe6cf41e3c90a82a7
SHA1 f13874509dd678414c280e2dbe8156aff36d6788
SHA512 b140016585fa22ffa888c9b5e3ab391286209e19e96b9e15604a2bef64ebb3ede9734168673435a2c9d2f67bb7440aaa3bc1ac6060fc4b07aed6a0acb9a0e717
SSDEEP 6144:Jv50aqCLO6HVolB/ELwavcEbb11DdSi8XdBLf:lqlCLD1olB/RavcEbJ8
TLSH
T188648B55B7F608F9EC73C13885A3A616E9727C060B30DEDB4760496A5F237D0AE3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	5112	2026-08-08_f951c6c7352b7fabe6cf41e3c90a82a7_cobalt-strike_icedid_njrat_satacom.exe

Executes dropped EXE 2 IoCs

pid	Process
2540	update.exe
1524	main.exe

Loads dropped DLL 1 IoCs

pid	Process
1524	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	update.exe
2540	update.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2540	5112	2026-08-08_f951c6c7352b7fabe6cf41e3c90a82a7_cobalt-strike_icedid_njrat_satacom.exe	89
PID 2540 wrote to memory of 1524	2540	update.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f951c6c7352b7fabe6cf41e3c90a82a7_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f951c6c7352b7fabe6cf41e3c90a82a7_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.dll

Path C:\Users\Admin\AppData\Local\Temp\license.dll
Size 242KB
SHA256 7cf361d95713759a42be07ab92fad0d5dd725e0e43a6f7ca39215458f650150c
MD5 624231997f56110864b3bc5ce629472e
SHA1 426ef1e46d6714ffa0da81037f697f836124f76f
SHA512 63280339719e000ba8edff3f4abf7be4a5c92bfe6e54fabfcfdd25bc498640802dc3c7ca6cb1795993de096a1791a4e5b7fe792eca4d80e9b136fa89baea9ef3
SSDEEP 6144:dmtB27eYZTR9zTatzLJSarFDnXctkHb+XpAo1:dICeaRtMLJXcB
TLSH
T132346B49B7A508F9E8B7C13DC9535606EBF2B8120370DBDB03904A6A6F277E05A3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Temp\main.exe
Size 415KB
SHA256 7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1
MD5 c26b5dac02757d3d8cb228177af7764f
SHA1 85e691be84991ef21b99bd5f3dc8e7cf767aab04
SHA512 6f2c2cea32e80eebaa33b7806920c773a1140e98771efacb3a5d158296de15da4e3bda83c17369a223740ec1210f1a52696bd0ff1ecab8f742f6097aeead1a9c
SSDEEP 6144:OoEM2gpj4IXUP66cbfJh4wK4cmbT/IgdSi8XdBLf:OoPaIXkKbflK4cmbv8
TLSH
T132947C16FBB610E9D873C0388663B227FA713C094B745EE75754595A6F237E09E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 828KB
SHA256 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451
MD5 818d35216668b3de116345d0823be43d
SHA1 9c334e3e6ed1e7c6e8e464902f737cb7c5567865
SHA512 ac004fe0a08abf41538e86ee8633d1e8ae2faf7aac5957150fcb5022155ab3de2865175fe9e8308c6412aab76af8c1cc9f7c596655fd39cb4ef9d7c914007c3d
SSDEEP 12288:rXc80rGME48k1jRICeaRtMLJXcBPoPaIXkKbflK4cmbv8:rXF0rxEcRICea3MGIXkKB5bv
TLSH
T10C057B56F7A614F9E873C1388A636616FAB27C150730DBEB03905A6A6F237D09D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download