Analysis
- max time kernel
164s - max time network
169s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/09/2026, 09:37
General
- Target 2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
- Size 3.7MB
- Sample260905-llk2psda75
- SHA256 4b0caed9aca30590a31591914feefb4117e170b736b076262df01c4b97a0cc31
Score
9/10
Malware Config
Signatures
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 6 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 7 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d56b8f7ef2b6cc7659b27cead78c58d_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\~tmp_69022.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_69022.tmp1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RemoteControllerService -s RemoteControllerService1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exe"C:\Windows\system32\conhost.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Svchost.dll
~tmp_69022.tmp
memory/2556-23-0x000001998C840000-0x000001998C841000-memory.dmp
memory/2780-7-0x00007FFD29A9C000-0x00007FFD29C5D000-memory.dmp
memory/2780-9-0x00007FFD4C6C0000-0x00007FFD4C6C2000-memory.dmp
memory/2780-10-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp
memory/2780-8-0x00007FFD4C6B0000-0x00007FFD4C6B2000-memory.dmp
memory/2780-13-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp
memory/2848-16-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp
memory/2848-19-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp
memory/2848-22-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp
memory/2848-24-0x00007FFD29A30000-0x00007FFD29F5F000-memory.dmp