b0e60fd332733f9682f9a6616b26a44700795e5a074626c8b319482d2bb88f30

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:54

Target
2026-08-10_73fab3a1e220a733aed1635cf8e1780a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 312KB
Sample260810-a89sssssez
SHA256 b0e60fd332733f9682f9a6616b26a44700795e5a074626c8b319482d2bb88f30
MD5 73fab3a1e220a733aed1635cf8e1780a
SHA1 670559b154477ee1417d6d0a2f6cfb610d4f88dc
SHA512 cf6550b766f454c77a2271c57c175432765a9c96e23c5e6d23fb8f40f1a8d5e86504f9a0e8a9aa4ad0ed9282db99ba5241e8e2818b4380d0dff0b6d9b643919d
SSDEEP 6144:aZUb5zwUR0pqa1xZrr9ih06LOxnbX8e8d:g9FdZiHLOxb5Y
TLSH
T122647D15F6A414F9EA77C23CCE424906EA72BC564761E6DF03904AA73F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

Inhibit System Recovery

pid	Process
3064	bcdedit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
1920	cmd.exe
2944	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

Direct Volume Access

pid	Process
5108	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 1920	5824	2026-08-10_73fab3a1e220a733aed1635cf8e1780a_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1920 wrote to memory of 5108	1920	cmd.exe	92
PID 5824 wrote to memory of 2944	5824	2026-08-10_73fab3a1e220a733aed1635cf8e1780a_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 2944 wrote to memory of 3064	2944	cmd.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_73fab3a1e220a733aed1635cf8e1780a_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_73fab3a1e220a733aed1635cf8e1780a_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3064