b371a772cfac82e4a367d9eb05a4d2934a22afb0ad5c238dce749cd00cffe891

General

Target
2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 870KB
Sample260809-er2hbatvht
SHA256 b371a772cfac82e4a367d9eb05a4d2934a22afb0ad5c238dce749cd00cffe891
MD5 3f4aa4e56ff3350092ac9dfaf6029805
SHA1 08875f35fa9451198b96475b34c8ed4d5b73839f
SHA512 e38983460e450080341c5be2ff89e1843375907a48adcf69834eb7d196f7f24301bde8d0d723ecdea34702038015650853d157b744e5cb52e5cb61d10ff92fd8
SSDEEP 12288:CNGG3U3ITEmUbqLELHBu0kWdzCsSJ5fDlwX++FuaxAKPV8xJ:cAIAmUbqojBuGF+5fyX+dcACmf
TLSH
T14915F115EBA814E9E273917CCD634601EB727C6D07A0A7CF13A449962F33AD19E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2648	SecurityHealthSystray.exe
5928	SecurityHealthSystray.exe
3580	GoogleUpdateCore.exe
2324	DeviceSyncHost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1696	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
572	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
572	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4296	schtasks.exe
3284	schtasks.exe
3436	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 5400	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 3376 wrote to memory of 4296	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 3376 wrote to memory of 4104	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 3376 wrote to memory of 3284	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 3376 wrote to memory of 4748	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 3376 wrote to memory of 3436	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3376 wrote to memory of 5928	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 3376 wrote to memory of 1696	3376	2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 1696 wrote to memory of 572	1696	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f4aa4e56ff3350092ac9dfaf6029805_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:5400
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240746640.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4296
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240747265.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3284
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4748
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240747875.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3436
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:5928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240748343.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:572

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:3580

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 931KB
SHA256 bb1d9c6f67cc57a07d7942c44a8be1603a73b92601adb642cf68aee2a9fa33ae
MD5 f8d091e8717ee6f1207f04f4a0418a1b
SHA1 a9c115985274234ac2ccf319a14b64bd76aed21c
SHA512 ce0d47b512d6b676ae56c6bf2e3c796a6209290b2e94f7b4c9f95e8fe1c3862017d3bc68137a7b5392e2204a03648056dd59e5a3515424c48fd8271ee76ca458
SSDEEP 12288:tNGG3U3ITEmUbqLELWDu0kWdzCsSJ5fDlwX++FuaxAKPV8xOukpSnPy:tAIAmUbqoyDuGF+5fyX+dcACmCca
TLSH
T1F315F115EBA814E9E173927CCD634601EB727C5D07A0A7CF13A489962F33AD19E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 929KB
SHA256 86fb3a008caa6d377036f06d5b2e38c9df247769b42f8300505cda5d1ed6a2ea
MD5 7bca4c74b61f368b6ad79d2fbfb0f8fc
SHA1 f153c8594cced57e54d3cca870a71d2d8198c878
SHA512 387621d5a9fa22a201b93ebbb242b11f51453fe619c9ec1c63a1e14f88d369aab53aa9b80fa1e80b7053901d6e2b2b68f7ffdd958acf1ac8fdf21f51fc8d9efb
SSDEEP 12288:RNGG3U3ITEmUbqLELB+u0kWdzCsSJ5fDlwX++FuaxAKPV8xI5:RAIAmUbqoN+uGF+5fyX+dcACmI
TLSH
T18315F115EBA814E9E173917CCD634601EB727CAD07A0A7CF13A449962F33AD19E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240746640.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240746640.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240747265.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240747265.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240747875.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240747875.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240748343.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240748343.bat
Size 250B
SHA256 ead10f57a7e19337229846c62a0d284527e0b158a6aa171febfd9b66c7264a19
MD5 b1539519802535d7906faafcb89e2725
SHA1 e8b0b8fbc731f0a8b0004cdfa8e3652bf8920add
SHA512 4213e8ba91e247005b56358036cad30ed224db0a4728f444ce2f281bb1c254e42c15e149c71539f7a224e54766826e880238715d6b8ec39b72b054a808b74d7d
TLSH
T13DD09763D2CAC6E00906A887019E598CC0A4FC0D0F80BB92C3E9C8291246488B9A6762
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 910KB
SHA256 9f0d84e73a4e753fb86136524316c3a771c3a7af559cb419fe8c7fdcd5a885fa
MD5 5dbc5c5a3389f9b5977fa74c13fa20af
SHA1 8901de3c866c9b875a05423531a1697030d1a382
SHA512 f4bd3d45321d1d1e2cc669783aa56e7c5a73cdac9c595b9b77895be1d8de10611f2466387078a5157cae2465172412e1ee0891dc5fdcaab695db8d6868bc9654
SSDEEP 12288:rNGG3U3ITEmUbqLELpCu0kWdzCsSJ5fDlwX++FuaxAKPV8xEXGx:PAIAmUbqotCuGF+5fyX+dcACmKu
TLSH
T19A15F115EBA814F9E273927CCD634601EB727C590760A7CF139489962F33AD19E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads