Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe
- Size 459KB
- Sample260820-dk13jayemg
- SHA256 45717ed7fb0e56acbc53863ba1ab82648f7a9f818306674368cc4e926d678d22
- MD5 a8cd5ebc9178a1c1820c7936e7e2d511
- SHA1 147f0cc1eb1dcdf0e1b89a535e50f516d36b2c57
- SHA512 8d563eb9d315dc1ac7e840da1e49fa2a5273cdb59c1d275a27cb18d0620b2ed65536e39f3bc0769bf1a461df14e2eaa74bfb10e570e1fa1f1fcd0d69083c2502
- SSDEEP 6144:hAELUPajm1wFf+8vpA5XlNHfWiknC5LWGHe81RfYjWvl2bsc5UrJB:hA3ParQ8vp+LfWdnuL+83YTD2JB
- TLSH T1D9A48D4AB39454F4E837D538CC424666E6767C168B60DB9F13A4772A3F332E09E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\MUIVerb = "Hosts Datei - Bearbeiten" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\SubCommands regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\command\ = "\"C:\\Windows\\hosts_off.cmd\"" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\Icon = "UserAccountControlSettings.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\command\ = "explorer.exe c:\\windows\\system32\\drivers\\etc" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\MUIVerb = "Hosts Datei" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\Icon = "UserAccountControlSettings.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\HasLUAShield regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\Icon = "UserAccountControlSettings.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\command\ = "\"C:\\Windows\\hosts_on.cmd\"" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\Icon = "UserAccountControlSettings.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\u\MUIVerb = "Hosts Datei - Ordner öffnen" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\runas\command\ = "notepad.exe %windir%\\system32\\drivers\\etc\\hosts" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\s\MUIVerb = "Hosts Datei - Schreibschutz aktiviert" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Icon = "UserAccountControlSettings.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\Hosts Datei\Shell\t\MUIVerb = "Hosts Datei - Schreibschutz deaktiviert" regedit.exe - Runs .reg file with regedit 1 IoCs
pid Process 6640 regedit.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6816 wrote to memory of 6640 6816 2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8cd5ebc9178a1c1820c7936e7e2d511_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6816 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s kontextmenue_hosts_datei.reg2⤵
- Modifies registry class
- Runs .reg file with regedit
PID:6640
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kontextmenue_hosts_datei.reg
- Size 3KB
- SHA256 c4a84178bfcc875e43e20f9ed4cf3271f7324a914946ab2e26db43e667169ea0
- MD5 b8b35321f5b9015cf45a37a50714f9b3
- SHA1 3b48c4508a7074016aef4cd8f524c067ae4118bd
- SHA512 9ad4472aca7ff481e2e34a5690a98e90fa00f2414eaf8254ed69b5aaaccb8414699b1c155913714ae55639399a48c9e44dde91f8dbdb518862d1e9f51d0afa2c
- TLSH T154613912D7E52004B7F36E94FFFA48639A32BA562D2EC08D11951B4D04B1E18E832BB7
- MD5 SHA1 SHA512 TLSH