Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe
- Size 136KB
- Sample260816-ebjmkaztes
- SHA256 c7d0a98f6a99cb32eab39b437c2581e90bb7ab50c51de415cb22737450bf7b4f
- MD5 c09546281933faa563d111db28980dd5
- SHA1 a72e2e14cf33db78b3a56a37da7c74c91c19f4d5
- SHA512 ccfaaa70fc9134895fd7e4847bb4a33d5b0d58e4b8f6322aa91dfc8169249a8416ceda7ba9841d1d954884d39cfb414012ada3970da4e1bc1a9414155cddf7be
- SSDEEP 3072:q6deDSHt2nGOix6VYIXOw0ABax91f9z1tfk7K1FK:qZicyI1Q91fhGsFK
- TLSH T1B7D35A5BB7E530F9E077963989614506EBB2B83107209BFF03A443662F236D19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 26 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Security.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\HardwareEvents.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Key Management Service.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Admin.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx notepad.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx notepad.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4300 notepad.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4980 set thread context of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4300 notepad.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 4300 notepad.exe Token: SeRestorePrivilege 4300 notepad.exe Token: SeSecurityPrivilege 4300 notepad.exe Token: SeTakeOwnershipPrivilege 4300 notepad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4300 notepad.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95 PID 4980 wrote to memory of 4300 4980 2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c09546281933faa563d111db28980dd5_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe2⤵
- Indicator Removal: Clear Windows Event Logs
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4300
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4CaptureMonitor.evtx
- Size 68KB
- SHA256 c61187b5d3f7dc3be4168c77420962e8f8084123102e11636edc00a8dcf4e948
- MD5 b26f6fdebc961b0ba9c81ec637d8625c
- SHA1 dacc11ec5fde7bae994a52fc53b3a6e85292e29b
- SHA512 10fc9962cc2cf13b7ba647ef034ef77a4c5e2e917e422a53444783cf95b833b09a492cf9c428bda40592a4bced08006b4b2ceb952f06332b83f231317402214d
- SSDEEP 3:MgAWl1l0c5MfaltpRTtPl2tVRl/lnRD:Mk8IMijRMlD
- TLSH T14563020476099812D1080A3944878BC1BF70FD501F7A9753A960363CCD753421952F59
- MD5 SHA1 SHA512 SSDEEP TLSH