46c6321f86c9a1092c9b59720bd0bf24918248b6f84e3c162bf7d954cbcf1e8b

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_da098835ce51c738a8d006a35b7c5709_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 10.1MB
Sample260822-243mgagg28
SHA256 46c6321f86c9a1092c9b59720bd0bf24918248b6f84e3c162bf7d954cbcf1e8b
MD5 da098835ce51c738a8d006a35b7c5709
SHA1 151ae0dc37b505f6ffe45e3d4f385c7d8d9a452c
SHA512 fcff04acb79d9d9ceeb7b94ac0690c6ccc3c1893d8a7a5541750c6b9747b78cbad826afdac4945f6b620e4547f5e95627e7f432f7f7234a0c425b07ba348153d
SSDEEP 196608:wKqDp05UrzVKc2MRrCidukHilJFjsLrivbTr3wjMqnTdx6CRZGGIcslMjlY:Tqe5UrZKcXrCeXH4vjWCn3MLnT2CRZAB
TLSH
T1EDB612D3F4AA225AEC4BA73FD672B802E775614E33959BCB124084C50E535E88B27F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c505-8.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4724-10-0x00007FFF16F70000-0x00007FFF16FBC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Executes dropped EXE 1 IoCs

pid	Process
4724	UpdateWindowsSDK2019.exe

Loads dropped DLL 1 IoCs

pid	Process
4724	UpdateWindowsSDK2019.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	UpdateWindowsSDK2019.exe
4724	UpdateWindowsSDK2019.exe
4724	UpdateWindowsSDK2019.exe
4724	UpdateWindowsSDK2019.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	2026-08-22_da098835ce51c738a8d006a35b7c5709_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4724	4152	2026-08-22_da098835ce51c738a8d006a35b7c5709_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-22_da098835ce51c738a8d006a35b7c5709_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_da098835ce51c738a8d006a35b7c5709_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\BL2Russifier_jojo\UpdateWindowsSDK2019.exe
  "C:\Users\Admin\AppData\Local\Temp\BL2Russifier_jojo\UpdateWindowsSDK2019.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UpdateWindowsSDK2019.exe

Path C:\Users\Admin\AppData\Local\Temp\BL2Russifier_jojo\UpdateWindowsSDK2019.exe
Size 4.5MB
SHA256 53aeb0e599c1bdc5a209f1a11cc5befcc6e613e44757601ea8a80ef5e3374641
MD5 e89459bbb2b8e32f289f0bab8cfb9e15
SHA1 ec969ab70e8f52e70f4d3d9bdccb713aff23d6a9
SHA512 0227be3f50c075be623f03f2bef2fa83cfbda603c20fe62531ada57d5392a3c71227c1a95dffa60d0a45f436fd1303009aaee8d51ff97cb716c64f317545b8d1
SSDEEP 98304:GZQJ55MhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1j:GKb54GpELcoR1j
TLSH
T174269DC6BE88F5E0C0A48834B916D57DC6737C3A8E11468732D7FB1F2A37191592B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION.dll

Path C:\Users\Admin\AppData\Local\Temp\BL2Russifier_jojo\VERSION.dll
Size 273KB
SHA256 550927d8924eaabdd95e2be5427772e8e91bcbd85d8a95698f6718d64ac6fecd
MD5 9ad7cb1d27cd0778327a8af6d3288128
SHA1 6574083decb45fdfd1211e9c61ef5cf42a802288
SHA512 5beb35da01ac85813903324a2ff9b5c01035b32c02d914d495eec8edf74c1eed1cab6507df39ce652b4b5922e495aa2637140a4612e591fe6d47c3f51941f6ce
SSDEEP 6144:W4m/6oPTWmh2222222222222222222vrDi2CFVCigAakysRMtbdL:W4myoSmh2222222222222222222fFCFq
TLSH
T1D9542917F39360FCC066E13466A7A6327A72FC184130ADAB16D5EE713D21E60667EE1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-10-0x00007FFF16F70000-0x00007FFF16FBC000-memory.dmp

Download