Overview

overview

10

Static

static

10

2026-08-10...lc.exe

windows10-2004-x64

9

2026-08-10...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 00:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 2.0MB
  • Sample260810-bbfdcssshs
  • SHA256 04a968b4e43d0c4248721abb2acf744f6f149cf0e92900793e9f59bfa7b3a3b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecution

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Modifies boot configuration data using bcdedit 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$in=[IO.File]::ReadAllBytes('C:\SyLoader\game\servers.nbt.tmp');$fs=[IO.File]::Create('C:\SyLoader\game\servers.dat.tmp');$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Compress);$gz.Write($in,0,$in.Length);$gz.Close();$fs.Close()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4448
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /enum {current}
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4384
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /enum {current}
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3828

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        servers.dat.tmp
        • Path C:\SyLoader\game\servers.dat.tmp
        • Size 115B
        • SHA256 a126dbd02575aed67b2d5799835e0b18878b0ca7a713789bbce1c16743fc5564
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        servers.nbt.tmp
        • Path C:\SyLoader\game\servers.nbt.tmp
        • Size 143B
        • SHA256 5846c7663e214ab5849f94c52358ec7def41d29c5e9a14eb8ab5ea3c9d8780da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_wfmae1nr.3lb.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wfmae1nr.3lb.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4448-3-0x000001AEEF3A0000-0x000001AEEF3B0000-memory.dmp
        Download

        memory/4448-2-0x000001AEEF3A0000-0x000001AEEF3B0000-memory.dmp
        Download

        memory/4448-9-0x000001AEEFC90000-0x000001AEEFCB2000-memory.dmp
        Download