Analysis
- max time kernel
100s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 01:03
General
- Target 2026-08-15_e5f6591158dd294575ec7c1320034600_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
- Size 1.1MB
- Sample260815-ben5nsda87
- SHA256 c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 38 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_e5f6591158dd294575ec7c1320034600_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_e5f6591158dd294575ec7c1320034600_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vault\cscript.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Vault\cscript.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
runtimebroker.dll
AppxState.dat
VERSION.dll
cscript.exe
memory/2208-248-0x000000000CFE0000-0x000000000D060000-memory.dmp
memory/2208-247-0x000000000CFE0000-0x000000000D060000-memory.dmp
memory/3932-82-0x000001F783DF0000-0x000001F783EF0000-memory.dmp
memory/3932-119-0x000001F7946C0000-0x000001F7946E0000-memory.dmp
memory/3932-81-0x000001F7838D0000-0x000001F7838F0000-memory.dmp
memory/3932-105-0x000001F783C30000-0x000001F783C50000-memory.dmp
memory/3932-73-0x000001F7801E0000-0x000001F7802E0000-memory.dmp
memory/5488-6-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-25-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-11-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-10-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-9-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-27-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-13-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-21-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-20-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-19-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-18-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-15-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-8-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-7-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-29-0x00007FFE82DE0000-0x00007FFE83043000-memory.dmp
memory/5488-30-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-14-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-38-0x00007FFE42F20000-0x00007FFE42F30000-memory.dmp
memory/5488-37-0x00007FFE82DE0000-0x00007FFE83043000-memory.dmp
memory/5488-36-0x00007FFE82F3F000-0x00007FFE82F40000-memory.dmp
memory/5488-39-0x00007FFE82DE0000-0x00007FFE83043000-memory.dmp
memory/5488-42-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-41-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-51-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-16-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-17-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-23-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-22-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-28-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-26-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-246-0x00007FFE82DE0000-0x00007FFE83043000-memory.dmp
memory/5488-12-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-24-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-258-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-259-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-261-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-262-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-263-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-266-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-265-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-270-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-274-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-278-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-282-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-281-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-286-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-288-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-290-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-294-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-298-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-302-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-303-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-306-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-311-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-315-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-319-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-321-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-323-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-327-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-328-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-331-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-334-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp
memory/5488-335-0x000001D8EBAE0000-0x000001D8EBD6B000-memory.dmp