Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe
- Size 1.1MB
- Sample260812-tbdtmsdf37
- SHA256 b49660b13329938128231255e8df1d7db917392a7cc0825b63d4dd8924e7ce83
- MD5 8c6103fe5c15a2a27c3823b68ca30285
- SHA1 933179ec6f883b82afdb5df3828e282b933360e0
- SHA512 8286fbd124f90b54c5ae138f9f60cac43ea390338b5bc94ee50492d45968d3732dd2b9e2779a8a5bc1496395b54c65b6a40cb92e21bfdde1d514a281f8df978f
- SSDEEP 24576:ikERpfKm0y5hDwRav1P7asD5ys7E1iHQFEBJjrJyz8eH:MD0y5hkWP7avUuiwFYVYhH
- TLSH T13D45BF12A7E640E8DC7AC6348A36A622AAB27C015F34A99F5394571E3F73F805F3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\moe_map\global.dat 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\moe_map\sdata.bin 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\moe_map\moe_map.log 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4992 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe 4992 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4992 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4992 2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4992