fbb5b278d2d69312aec84b6da38820a30f949b36e53596f25912c278843d1764

General

Target
2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 684KB
Sample260809-zy7ccsce55
SHA256 fbb5b278d2d69312aec84b6da38820a30f949b36e53596f25912c278843d1764
MD5 036602bb3d2af57fd4c671fa9dda3cbe
SHA1 44448b3b36f2fd03a017b67dcf23e9b0f0a7dc38
SHA512 de16f1133c2b989e04f0bec5ee712c5251ec333a943bdf0dbe10c87ea72258712d18def57b51a7dc9f18a5801d1f6ccb95069f0dac8a7ae39c557b0953a1af36
SSDEEP 12288:9NGG3U3ITEmUbqLELei/2URx4b/XIU5LAc/xxHbVlki4IzUl8wQ:9AIAmUbqoi62/zIEz/bzkiDzU+wQ
TLSH
T17CE4E115EBA814F9E277813CCD634605EAB27C9A0760E7CF13944A962F376D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
612	GoogleUpdateCore.exe
1512	SecurityHealthSystray.exe
4972	SecurityHealthSystray.exe
1536	DeviceSyncHost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1740	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4244	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4244	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
220	schtasks.exe
1768	schtasks.exe
1540	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2068	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 4572 wrote to memory of 1540	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 4572 wrote to memory of 3356	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 4572 wrote to memory of 220	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4572 wrote to memory of 1236	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 4572 wrote to memory of 1768	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	102
PID 4572 wrote to memory of 1512	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 4572 wrote to memory of 1740	4572	2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 1740 wrote to memory of 4244	1740	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_036602bb3d2af57fd4c671fa9dda3cbe_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:2068
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240672531.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1540
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:3356
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240672828.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:220
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1236
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240673187.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1768
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240673593.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4244

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:612

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:4972

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 740KB
SHA256 5ca5c2fbba804548d291555cc535b78689ab4bf54518260cd1c75d71a9d3a187
MD5 cf0a025b74119cfa2367c7a98169f570
SHA1 61b13cb1ce69970517fcaec295963efe7b1508d8
SHA512 324435c770b86d740fc50a2c760809b95c45e67d0a62d2bec9ef1753821664fea6aced1db4c61f709e716381ce706e60e4d578dc3c5e2f238ab6cefc66017a13
SSDEEP 12288:QNGG3U3ITEmUbqLELB+/2URx4b/XIU5LAc/xxHbVlki4IzUl8wmGJ:OAIAmUbqo1+2/zIEz/bzkiDzU+wmGJ
TLSH
T156F4E115EBA814F9E277813CCD634606DAB27C9A0760D7CF13948A562F37AD09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 729KB
SHA256 76a44a33aa0b534eccec6541a23abf833c6f6a9df61baa5e8cd93cd5956f2f74
MD5 10c0416ad52be1bc96cf16cb88c79a05
SHA1 0afff3016e73f596df1ef76207e6137448eab0be
SHA512 c08ebf9e33ee86874ef2836154fd7e41ce61dd9eae0ff00c22e5d0500a54a1a6a764a433e1dc2ce505c805c2001dfc8bae11b66f3948a4692b99965c082e750b
SSDEEP 12288:GNGG3U3ITEmUbqLELJ2/2URx4b/XIU5LAc/xxHbVlki4IzUl8wA:wAIAmUbqo922/zIEz/bzkiDzU+wA
TLSH
T12DF4E115EBA814F9E277813CCD634606EAB2BC9A0760D7CF13944A562F376D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240672531.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240672531.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240672828.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240672828.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240673187.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240673187.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240673593.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240673593.bat
Size 250B
SHA256 e6425b27cd681cd876ee5d72bb30d8b935971846c6b0187b4af3e6f355d07203
MD5 4be078e58e17906bb6a065a2b852ca51
SHA1 f9c28e6b01c04c990585f84ab7e44b15bf2b69cd
SHA512 1a10d556dd9f3663ec06d4af0a154653b012f2fb4fb7c7c800c1c426965e8e9195ecae30a8ed05bd27eca8a444716db0776628e01a742d380878487ad00c6a9e
TLSH
T10ED0979782CBC3E8041AAC86419C040CC0A2E88C0F8133838799A81C138A208B457B41
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 725KB
SHA256 85944b4461f738f6cadbc3e8dd850870bcc12d172dc8d373c1658e55a7df0b91
MD5 341c0799435b1ff7cafe7f3c01e09215
SHA1 4ef155390858112b7f1a2be1efc4f955397dd7bf
SHA512 363301d59d45514b6cd6cc80ba47e7de1edd4da14891a8e296e3429bc60b86e8373b175424a961782263348a03bb9b3605faa37aa142bc6777cb36d7a6fcfb71
SSDEEP 12288:ONGG3U3ITEmUbqLELXN/2URx4b/XIU5LAc/xxHbVlki4IzUl8w+s:IAIAmUbqojh2/zIEz/bzkiDzU+wv
TLSH
T164F4E115EBA810F9E277817CCD634602EA727C9A0760D7DF23A44A962F376D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads