Overview

overview

10

Static

static

10

2026-08-10...lc.exe

windows10-2004-x64

9

2026-08-10...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 00:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 2.0MB
  • Sample260810-bbfdcssshs
  • SHA256 04a968b4e43d0c4248721abb2acf744f6f149cf0e92900793e9f59bfa7b3a3b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecution

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Modifies boot configuration data using bcdedit 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$in=[IO.File]::ReadAllBytes('C:\SyLoader\game\servers.nbt.tmp');$fs=[IO.File]::Create('C:\SyLoader\game\servers.dat.tmp');$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Compress);$gz.Write($in,0,$in.Length);$gz.Close();$fs.Close()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3268
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /enum {current}
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:6792
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /enum {current}
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        servers.dat.tmp
        • Path C:\SyLoader\game\servers.dat.tmp
        • Size 115B
        • SHA256 a126dbd02575aed67b2d5799835e0b18878b0ca7a713789bbce1c16743fc5564
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        servers.nbt.tmp
        • Path C:\SyLoader\game\servers.nbt.tmp
        • Size 143B
        • SHA256 5846c7663e214ab5849f94c52358ec7def41d29c5e9a14eb8ab5ea3c9d8780da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3268-2-0x00007FFBBA9CF000-0x00007FFBBA9D0000-memory.dmp
        Download

        memory/3268-6-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-5-0x000001BBFD4E0000-0x000001BBFD502000-memory.dmp
        Download

        memory/3268-7-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-8-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-10-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-11-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-14-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download

        memory/3268-15-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
        Download