45717ed7fb0e56acbc53863ba1ab82648f7a9f818306674368cc4e926d678d22

General

Target
2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Size 459KB
Sample260820-dk13jayemg
SHA256 45717ed7fb0e56acbc53863ba1ab82648f7a9f818306674368cc4e926d678d22
MD5 a8cd5ebc9178a1c1820c7936e7e2d511
SHA1 147f0cc1eb1dcdf0e1b89a535e50f516d36b2c57
SHA512 8d563eb9d315dc1ac7e840da1e49fa2a5273cdb59c1d275a27cb18d0620b2ed65536e39f3bc0769bf1a461df14e2eaa74bfb10e570e1fa1f1fcd0d69083c2502
SSDEEP 6144:hAELUPajm1wFf+8vpA5XlNHfWiknC5LWGHe81RfYjWvl2bsc5UrJB:hA3ParQ8vp+LfWdnuL+83YTD2JB
TLSH
T1D9A48D4AB39454F4E837D538CC424666E6767C168B60DB9F13A4772A3F332E09E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\MUIVerb = "Hosts Datei - Ordner öffnen"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\command\ = "explorer.exe c:\\windows\\system32\\drivers\\etc"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\MUIVerb = "Hosts Datei - Bearbeiten"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\MUIVerb = "Hosts Datei - Schreibschutz deaktiviert"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Icon = "UserAccountControlSettings.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\MUIVerb = "Hosts Datei"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\SubCommands	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\command\ = "notepad.exe %windir%\\system32\\drivers\\etc\\hosts"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\Icon = "UserAccountControlSettings.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\HasLUAShield	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\Icon = "UserAccountControlSettings.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\MUIVerb = "Hosts Datei - Schreibschutz aktiviert"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\Icon = "UserAccountControlSettings.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\command\ = "\"C:\\Windows\\hosts_on.cmd\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\command\ = "\"C:\\Windows\\hosts_off.cmd\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\Icon = "UserAccountControlSettings.exe"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4112	regedit.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4112	3288	2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe" /s kontextmenue_hosts_datei.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kontextmenue_hosts_datei.reg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kontextmenue_hosts_datei.reg
Size 3KB
SHA256 c4a84178bfcc875e43e20f9ed4cf3271f7324a914946ab2e26db43e667169ea0
MD5 b8b35321f5b9015cf45a37a50714f9b3
SHA1 3b48c4508a7074016aef4cd8f524c067ae4118bd
SHA512 9ad4472aca7ff481e2e34a5690a98e90fa00f2414eaf8254ed69b5aaaccb8414699b1c155913714ae55639399a48c9e44dde91f8dbdb518862d1e9f51d0afa2c
TLSH
T154613912D7E52004B7F36E94FFFA48639A32BA562D2EC08D11951B4D04B1E18E832BB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing