611e733e70f3876f3d931ec537fb627ad482f249e346a74170c8b1c61bc03cdb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.7MB
Sample260820-hmvezsca23
SHA256 611e733e70f3876f3d931ec537fb627ad482f249e346a74170c8b1c61bc03cdb
MD5 a74c0da730af45af3efa3a69be08159c
SHA1 cb67c6bb44a4c9bed4bcf38014c9529719cd63c6
SHA512 dbacc92b67715c6c71a84ce3bd054f736ea4151d21c98f15e21cc9506951fe4db165fe0fc8d05e495b8c45de4a75983c7d4297b5f5a807df93d01a5a8bd3a165
SSDEEP 24576:YltqDNfTdF9ehQ1mJ+0ugY670BvhrC63AXU4fv9W/L09:zDNpfqQ8Q0uA7SAXdfC
TLSH
T1BA858E07A3B540ECD16BC179CA165A07EBB174491330ABDB57D0CAA62F23BE15A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
3136	2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads