cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc

General

Target
2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.6MB
Sample260816-e9sm5adk3x
SHA256 cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc
MD5 4fb0b3996d6b58eb17b133528800d134
SHA1 094802ad7f372ae6a670f37c77d04000dcc92986
SHA512 56ca8cf62b339830d92f076a5d5a855d873c1a2138d5ac2e13c572cba940a7ebabe116ca07e793c854fd3f786ae5ca4b33742a633894e6327636d58c08a48342
SSDEEP 49152:Wp888OhpdWIxJ1T1f0j3f3CQVHMTyEfa34OKEe5:ludWIP1TOfszJE2
TLSH
T162758E0AA2B901F8D067D179C9065517EBB2B8051F34A7DF5790CEA62F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	ip-api.com

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2168	cmd.exe
4644	cmd.exe
3164	cmd.exe
2340	cmd.exe
3372	cmd.exe
5084	cmd.exe
2588	cmd.exe
4004	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3372	cmd.exe
4772	PING.EXE

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1600	taskkill.exe
4880	taskkill.exe
1684	taskkill.exe
3052	taskkill.exe
4916	taskkill.exe
4260	taskkill.exe
4072	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4772	PING.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	1684	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 5084	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	85
PID 5084 wrote to memory of 4880	5084	cmd.exe	87
PID 3204 wrote to memory of 2588	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 2588 wrote to memory of 1684	2588	cmd.exe	91
PID 3204 wrote to memory of 4004	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 4004 wrote to memory of 3052	4004	cmd.exe	94
PID 3204 wrote to memory of 2168	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 2168 wrote to memory of 4916	2168	cmd.exe	97
PID 3204 wrote to memory of 4644	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4644 wrote to memory of 4260	4644	cmd.exe	100
PID 3204 wrote to memory of 3164	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3164 wrote to memory of 4072	3164	cmd.exe	103
PID 3204 wrote to memory of 2340	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 2340 wrote to memory of 1600	2340	cmd.exe	107
PID 3204 wrote to memory of 3372	3204	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	122
PID 3372 wrote to memory of 4772	3372	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM browser.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM firefox.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM Discord.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4772