36f4ed886d0e1f4fc2532b1a6e8312dbc4fca54be25b3e20b2b569a813aeab01

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 17.8MB
Sample260822-d33dbavvgy
SHA256 36f4ed886d0e1f4fc2532b1a6e8312dbc4fca54be25b3e20b2b569a813aeab01
MD5 c4fcebdf71b3df99e1e14b2cfffb2a25
SHA1 39fa26691e53f786921486299e6f6f4fae76ef59
SHA512 7deb1cdab5b0c5b007b0104ef2f35d7a8bc327ce243e11702ea2cd8adb0d027fa9a66703586af2f891098e714baae79113b1ef9b63368ca2d2e80b9e124a22b5
SSDEEP 393216:4OMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:49Uy4wU7a3VQjzzW9ldh
TLSH
T1CC173315A6B402F8D0BBD2B4DE534913EA72784953319AFB02D192561F2BEE0DE3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c59d-1.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Deletes itself 1 IoCs

pid	Process
4732	VexOS-Loader.exe

Executes dropped EXE 1 IoCs

pid	Process
4732	VexOS-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\VexOS\\Loader\\VexOS-Loader.exe\" \"%1\""	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker	VexOS-Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\ = "URL:VexOS Checker Protocol"	VexOS-Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\URL Protocol	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\shell\open\command	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\shell	VexOS-Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\vexoschecker\shell\open	VexOS-Loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4732	4140	2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
  "C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe" --vexos-cleanup-source-pid 4140 --vexos-cleanup-source-path "C:\Users\Admin\AppData\Local\Temp\2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VexOS-Loader.exe

Path C:\Users\Admin\AppData\Local\VexOS\Loader\VexOS-Loader.exe
Size 17.8MB
SHA256 36f4ed886d0e1f4fc2532b1a6e8312dbc4fca54be25b3e20b2b569a813aeab01
MD5 c4fcebdf71b3df99e1e14b2cfffb2a25
SHA1 39fa26691e53f786921486299e6f6f4fae76ef59
SHA512 7deb1cdab5b0c5b007b0104ef2f35d7a8bc327ce243e11702ea2cd8adb0d027fa9a66703586af2f891098e714baae79113b1ef9b63368ca2d2e80b9e124a22b5
SSDEEP 393216:4OMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:49Uy4wU7a3VQjzzW9ldh
TLSH
T1CC173315A6B402F8D0BBD2B4DE534913EA72784953319AFB02D192561F2BEE0DE3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VexOS Launcher.lnk

Path C:\Users\Admin\Desktop\VexOS Launcher.lnk
Size 2KB
SHA256 8f312f934184184153f4b0286bd8bff0bb4d9b4a57d8365aa60ecc06fd7bb125
MD5 143cb5e482a14a1f8474246292ddad39
SHA1 7dba8f7ffe60d544ceb6b4aacc4a91adf1f57720
SHA512 d3d291e85b71a36dcb28b5392df374de2c3b532d93e63a62dcc7dc405cf0b0f4c8a34835a6c8e1262c92b4b04e9a1ba499ba21b5eaaf4a8bdaa02f21a3f4cf22
TLSH
T1DD41AA899DD73325C27BD6B846F71115C37EF0BADB029E1E0094868A0C727129B06F2F
MD5 SHA1 SHA512 TLSH