cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc

General

Target
2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.6MB
Sample260816-e9sm5adk3x
SHA256 cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc
MD5 4fb0b3996d6b58eb17b133528800d134
SHA1 094802ad7f372ae6a670f37c77d04000dcc92986
SHA512 56ca8cf62b339830d92f076a5d5a855d873c1a2138d5ac2e13c572cba940a7ebabe116ca07e793c854fd3f786ae5ca4b33742a633894e6327636d58c08a48342
SSDEEP 49152:Wp888OhpdWIxJ1T1f0j3f3CQVHMTyEfa34OKEe5:ludWIP1TOfszJE2
TLSH
T162758E0AA2B901F8D067D179C9065517EBB2B8051F34A7DF5790CEA62F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2784	cmd.exe
1048	cmd.exe
3760	cmd.exe
5480	cmd.exe
5960	cmd.exe
4876	cmd.exe
1228	cmd.exe
1668	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2784	cmd.exe
2304	PING.EXE

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2520	taskkill.exe
2924	taskkill.exe
3472	taskkill.exe
4688	taskkill.exe
3056	taskkill.exe
1900	taskkill.exe
2556	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2304	PING.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1048	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1048 wrote to memory of 2520	1048	cmd.exe	92
PID 5000 wrote to memory of 3760	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3760 wrote to memory of 2924	3760	cmd.exe	96
PID 5000 wrote to memory of 5480	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 5480 wrote to memory of 3472	5480	cmd.exe	99
PID 5000 wrote to memory of 5960	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 5960 wrote to memory of 4688	5960	cmd.exe	102
PID 5000 wrote to memory of 4876	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 4876 wrote to memory of 3056	4876	cmd.exe	105
PID 5000 wrote to memory of 1228	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 1228 wrote to memory of 1900	1228	cmd.exe	108
PID 5000 wrote to memory of 1668	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 1668 wrote to memory of 2556	1668	cmd.exe	111
PID 5000 wrote to memory of 2784	5000	2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 2784 wrote to memory of 2304	2784	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM browser.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM firefox.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM Discord.exe /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2304