b8786dc2a86a4711d23d649311dffa7890b5482fa67d12d79fe1700ddf1a7ce4

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_edde024307100b80661bbfc24df78c9d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 640KB
Sample260909-lstmesvbmb
SHA256 b8786dc2a86a4711d23d649311dffa7890b5482fa67d12d79fe1700ddf1a7ce4
MD5 edde024307100b80661bbfc24df78c9d
SHA1 440e276dd139a296c89475a7ae6ec50bb8367293
SHA512 663ad64594422d4ae8cdbea073abb0e260844f8fdcbc31733bf363929cc0e5c30c20150f51b1b662d7975e2eb34a80e50a02846e4438a1f682b6bb8470dd665c
SSDEEP 12288:rNGG3U3ITEmUbqLELkd/3ka49WURidBTtGbWqxoZSAK:PAIAmUbqogxRhzZ+HmSAK
TLSH
T1C1D4D125FBA814F9E2738178CD638605EB727C5A077097CF13948A962F23AD19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-09-09_edde024307100b80661bbfc24df78c9d_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_edde024307100b80661bbfc24df78c9d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads