Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 07:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 12.5MB
- Sample260825-hzpp9stybw
- SHA256 58dfd618b74eb8665c69076436664ae0fbeac92042e4626baa398737bf57b359
- MD5 95bd9b7178c44c8e8b663d02af2ab8fc
- SHA1 a63b6a53ca6cf83934e141b225ccb51440bd46d2
- SHA512 b3c928654841171c6dab40a6a8aac6e2124aae84b00316aa33a50da5ae9dc1e41a89b9102864955bd43f437eef683edf7bda742bb572e1e2f761d4082263a234
- SSDEEP 196608:wijLEuwyDMSIFzDuXeNzNbfTLzjpn1R11njtZXb1ZGt/wVjhta9mLdzk05:wiRwyDDYkuo4Fhk9mdB
- TLSH T151D64A4A62B09698E55535FAFF8734B6C322FE428ACB132787B0F94975F335F560A060
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5068 Feather_Runtime.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe 5068 Feather_Runtime.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5700 wrote to memory of 5068 5700 2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_95bd9b7178c44c8e8b663d02af2ab8fc_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe"C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Feather_Runtime.exe
- Size 11.9MB
- SHA256 339af5a404d366ea2271d41fccc9bf3089f628d95e6763e1f630db958202a52a
- MD5 a7f675cfb6da8c561220a8bce156caa7
- SHA1 d06a2e7e3d00e616df100b76534f68b7a06043f2
- SHA512 dec009c3a7edb2076e3f3973fecfc4df3992a911c8cff7cfddd5216e4dd36066efe9ff969e7b274adc89a249051be26b4d7a1a8701fdcd88e6038817723d6cd4
- SSDEEP 98304:+lHMmIao/Y7mgTm05AwJHE6hDE0nFb9POZq+o3rQFavHdBDvYLV41N:WZkg7PAmkgEyFb1OZqHcIFpwq
- TLSH T175C69DF07350C1A4D73EC1B4C8214BFBD7223D29EB81A5C79BA8BDA17B3F6851999484
- MD5 SHA1 SHA512 SSDEEP TLSH