Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 09:37
General
- Target 2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
- Size 3.7MB
- Sample260905-llk2psda75
- SHA256 4b0caed9aca30590a31591914feefb4117e170b736b076262df01c4b97a0cc31
Score
9/10
Malware Config
Signatures
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 6 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 7 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\~tmp_41218.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_41218.tmp1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RemoteControllerService -s RemoteControllerService1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exe"C:\Windows\system32\conhost.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Svchost.dll
~tmp_41218.tmp
memory/1220-16-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/1220-19-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/1220-22-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/1220-24-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/3616-7-0x00007FF849D9C000-0x00007FF849F5D000-memory.dmp
memory/3616-10-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/3616-9-0x00007FF866220000-0x00007FF866222000-memory.dmp
memory/3616-8-0x00007FF866210000-0x00007FF866212000-memory.dmp
memory/3616-13-0x00007FF849D30000-0x00007FF84A25F000-memory.dmp
memory/4684-23-0x000001CDC8EA0000-0x000001CDC8EA1000-memory.dmp