c3726c1efa2de71b4cf4da93c6ace3e41f076a15026ac55c613ee60e159dfde5

General

Target
2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 729KB
Sample260810-2j646avyex
SHA256 c3726c1efa2de71b4cf4da93c6ace3e41f076a15026ac55c613ee60e159dfde5
MD5 49118b812efabecce747e7aabd47f8b7
SHA1 4d7a92d14c65bbbbac5d5772f504b5d6ce003b2c
SHA512 8c6b78207e1213f3a316ae0eec00d4d06bd8cb76382235f5facf2a749c6f33fb88767ce5fb04694fcb12a7208f2de550abc84c21fd52f6c1e539bf812d975edd
SSDEEP 12288:TNGG3U3ITEmUbqLELflrITpx34F9aE3q51icPEX1jqSWdUtkhvMq5:nAIAmUbqormNBn1icP+LWkkz5
TLSH
T176F4E115FBA814F9E177D13CCD634606EAB2BC990760A7CF23944A562F23AD18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2484	SecurityHealthSystray.exe
3972	GoogleUpdateCore.exe
228	SecurityHealthSystray.exe
756	DeviceSyncHost.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com
15	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
384	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3288	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3288	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
616	schtasks.exe
5112	schtasks.exe
3176	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3308	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 1260 wrote to memory of 3176	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 1260 wrote to memory of 988	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1260 wrote to memory of 616	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 1260 wrote to memory of 1956	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 1260 wrote to memory of 5112	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 1260 wrote to memory of 2484	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 1260 wrote to memory of 384	1260	2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 384 wrote to memory of 3288	384	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_49118b812efabecce747e7aabd47f8b7_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:3308
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240680796.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3176
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:988
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240681187.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:616
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240681593.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5112
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240681812.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3288

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:228

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 742KB
SHA256 3c8b4562066d107706e97cd8b06141a6d44f1d0f5501f4d10c854e9e775c6c05
MD5 f1271be60f02e06107f0a941712d253f
SHA1 b967f010b64e7796fa26938193e5bd89fe041051
SHA512 1e63f1cc7e5f8b41fd4631cc27ace58af7324d4b4cc8c9a3061f3f180ff0b41f95e502dd21c7b11da638fa7d5dacc26d76b7d5ff112224144a4184fef5fd3010
SSDEEP 12288:MNGG3U3ITEmUbqLELS/rITpx34F9aE3q51icPEX1jqSWdUtkhvMqf:aAIAmUbqou0NBn1icP+LWkkzf
TLSH
T174F4F115EBA810F9E177D17CCD734606EAB2BC990760A7CF23944A562F23AD18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 766KB
SHA256 155a340b3c4c4b221776294ca8f8699232c9adc7b0d47905ccba7becd3cc00a5
MD5 f39dedb3c1857cbcc5b2d667d0fc1eaa
SHA1 d63378bb39dd8380619e46d4169a0227fe146c74
SHA512 142b7d0b7e86cbd33056e024e97c52fa441d1820d86eac76ee27648aabace2dceb73e4627234266744f4f046c9b7c42c1dbd97e393f27ed85fa435b5e2deeb1a
SSDEEP 12288:nNGG3U3ITEmUbqLEL64rITpx34F9aE3q51icPEX1jqSWdUtkhvMqMhZKLX:bAIAmUbqoOzNBn1icP+LWkkzMhiX
TLSH
T151F4F115FBA814F9E1B7D13CCE634606EAB2BC99076097CF239449562F236D18E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240680796.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240680796.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240681187.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240681187.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240681593.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240681593.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240681812.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240681812.bat
Size 250B
SHA256 9f8c27f302bc141c4a25f902b639fc9433e6ab3d444618a8face21bda9fe12c6
MD5 0f4987111a06a01ffe93ec15767222a4
SHA1 fdad9b536983aa3dfa4785de8a37b2baa333e456
SHA512 c357e3fe89792c6cc947a91a6622c8419c11525769dd51fcf451ad0b18fbf83df372d4ad169efc6d8b3259c0f11734de466b8366f7342c4e55e75e0b1ae9ec7d
TLSH
T115D09553D34FC3E90407A153405E598C40A2F8940F803B914355C8581354008F4D7781
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 744KB
SHA256 a40c2628e48d65e867d23899843cb551484ef6133020744a0f27d2f0b7721e18
MD5 fdb04902ad30c185fc5ee90c6209d7e0
SHA1 2a221b6bdcc7b3ed4fd05d55815e780f69375357
SHA512 39af3c08b414d0631cf50e4dabe3628632eb0c710bf68dd1411c6933e3840b2b3d0937ef0dc6549cce702a5eed546606bc675ca5dfb900808acdc95bcbe53245
SSDEEP 12288:WNGG3U3ITEmUbqLELe0rITpx34F9aE3q51icPEX1jqSWdUtkhvMqe:AAIAmUbqoCPNBn1icP+LWkkze
TLSH
T1F4F4E115FBA814F9E177D13CCD634606EAB2BC99076097CF23944A962F236D18E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads