d4bbc576f3fdc077b2c0ee984833febd882a6d10efd58edd69fa0fe04d34d64e

General

Target
2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 17.7MB
Sample260812-m45phacb73
SHA256 d4bbc576f3fdc077b2c0ee984833febd882a6d10efd58edd69fa0fe04d34d64e
MD5 51db40b2f4fea012c70354577ac112dd
SHA1 10cf73708f9a6c849c45e57da9e0b4cf321c1ded
SHA512 e3e0ee41eec9ec1e09515894fdb42274eae1c32015e836e77aba618fa47410b819e9a7377971642972c47b6701354c1ae726a2fa288d826d89fbf2374ad8b739
SSDEEP 393216:CWMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:C1Uy4wU7a3VQjzzW9ldh
TLSH
T12E173325A6B401F8D0BBD274DEA30913EA72784953319AFB02D156651F2AEE0DF3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c586-1.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x001100000001c588-8.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/3680-14-0x00007FF71A070000-0x00007FF71B21E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Deletes itself 1 IoCs

pid	Process
3680	VexOS-Loader.exe

Executes dropped EXE 2 IoCs

pid	Process
3680	VexOS-Loader.exe
2808	VexOS-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\shell\open\command	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\shell	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\shell\open	VexOS-Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\VexOS\\Loader\\VexOS-Loader.exe\" \"%1\""	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker	VexOS-Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\ = "URL:VexOS Checker Protocol"	VexOS-Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\vexoschecker\URL Protocol	VexOS-Loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3680	856	2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 3680 wrote to memory of 2808	3680	VexOS-Loader.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
  "C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe" --vexos-cleanup-source-pid 856 --vexos-cleanup-source-path "C:\Users\Admin\AppData\Local\Temp\2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
    "C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe" --vexos-cleanup-source-pid 856 --vexos-cleanup-source-path "C:\Users\Admin\AppData\Local\Temp\2026-08-12_51db40b2f4fea012c70354577ac112dd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VexOS-Loader.exe

Path C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
Size 17.7MB
SHA256 d4bbc576f3fdc077b2c0ee984833febd882a6d10efd58edd69fa0fe04d34d64e
MD5 51db40b2f4fea012c70354577ac112dd
SHA1 10cf73708f9a6c849c45e57da9e0b4cf321c1ded
SHA512 e3e0ee41eec9ec1e09515894fdb42274eae1c32015e836e77aba618fa47410b819e9a7377971642972c47b6701354c1ae726a2fa288d826d89fbf2374ad8b739
SSDEEP 393216:CWMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:C1Uy4wU7a3VQjzzW9ldh
TLSH
T12E173325A6B401F8D0BBD274DEA30913EA72784953319AFB02D156651F2AEE0DF3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VexOS-Loader.exe

Path C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
Size 17.8MB
SHA256 6189f29e584b787bca7bb35f24c1b44a377a28d844f00b525740aaf041106758
MD5 b57e7392481cb03770fccdffd7def6e7
SHA1 d1d0d3c3fb33da103a61b6018e3ff82c8990ac4e
SHA512 b07444b8ab453b00cd89f7cc8dec633d92b8b6404a00effa64250019ce547a751045c75fc63e9bb02f8ba64048a4694baf74d2c769055ebbdfaa7b2c23368fcf
SSDEEP 393216:WaMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:WpUy4wU7a3VQjzzW9ldh
TLSH
T1BD173315A6B401F8D0BBD2B4DE530913EA7278496331AAFB02D156561F2BAE0DF3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VexOS Launcher.lnk

Path C:\Users\Admin\Desktop\VexOS Launcher.lnk
Size 2KB
SHA256 8ff64f54a2d12fecbba6ecfe48033e08b125a00a1ec5c5899f17d127124f6886
MD5 94d41db5d88fb7fbb4e7c0cdcd8a0ce9
SHA1 4cae7a2a960a041bc32602e259bfa01b85f1d823
SHA512 8f9833923b0e674c091e34cb4da20b5c965744776a1ca193d6b05eafc60081b3416923a99a37fb5d3a106506df95f31c73f6583ef5a0a51ab837be806fee6fca
TLSH
T1414159855DE72721D37BDA7517BB2128D77AB063A61B9E1D008497860CA2B069A02F1F
MD5 SHA1 SHA512 TLSH

Submit Download

VexOS Launcher.lnk

Path C:\Users\Admin\Desktop\VexOS Launcher.lnk
Size 2KB
SHA256 e5a24a3cf534d4b42174427f56747f852552ca7a7a5589d12bdd5bfe3ff058e5
MD5 b6e06e1b1b246682330b50b23cbccd95
SHA1 43b845edc10b0c6fa8b0fccbdccb74c4c37f2cb6
SHA512 925ed212104ccdbbab10e55736df65f014542a9999d2de1ca94edee5b31c479f041d9b6a918c16253e55c5b0cec8bbefd19e69838355e4749707877f2a8ba44c
TLSH
T1A741AC855DD72321D37BD9B507B72224D77AF0B7A71BDE1D008487490CA27069A02F2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3680-14-0x00007FF71A070000-0x00007FF71B21E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads