f7231b2c7ae9eb3406afebaeafcb142a6867aabd2e316274847f16eba229bde1

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 343KB
Sample260910-hc3nlssva1
SHA256 f7231b2c7ae9eb3406afebaeafcb142a6867aabd2e316274847f16eba229bde1
MD5 3220158cc726ee2778d885885b44407f
SHA1 ebda375932630a32667c021d7df0856d6056fe72
SHA512 0751d8f8afe68c73aba43135b58fb6efab3802d9b1d47c697d1c5735109e64282e513ac0a20726aa6aec6b460cf92969201ee0eb64139b91bd8c5288ef245a3d
SSDEEP 6144:2H3QGQKcH9h5FlWl57cEOa6DRgJ9G/yJ6iR7HdC6Wv8AK:2XQX+JCDRgJ9J6iR5C6WT
TLSH
T185749D29FBA414F9E67BC17CC9530906EA72BC9A0760ABCF13944A562F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4276	crdmon.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe
5032	cmd.exe
5696	cmd.exe
5312	cmd.exe
5320	cmd.exe
5468	cmd.exe
1344	cmd.exe
1132	cmd.exe
6108	cmd.exe
1716	cmd.exe
2872	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4624	schtasks.exe
5936	schtasks.exe
1836	schtasks.exe
1672	schtasks.exe
2588	schtasks.exe
1300	schtasks.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1716	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 1716 wrote to memory of 4624	1716	cmd.exe	91
PID 1860 wrote to memory of 2872	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 1860 wrote to memory of 5468	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 5468 wrote to memory of 5936	5468	cmd.exe	99
PID 1860 wrote to memory of 2308	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 1860 wrote to memory of 5032	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 5032 wrote to memory of 1836	5032	cmd.exe	105
PID 1860 wrote to memory of 5696	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 1860 wrote to memory of 1344	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 1344 wrote to memory of 1672	1344	cmd.exe	110
PID 1860 wrote to memory of 1132	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	111
PID 1860 wrote to memory of 5312	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 5312 wrote to memory of 2588	5312	cmd.exe	115
PID 1860 wrote to memory of 6108	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	116
PID 1860 wrote to memory of 5320	1860	2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe	118
PID 5320 wrote to memory of 1300	5320	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c /c schtasks /query /tn "Microsoft\Windows\Crypto\CredMon"
  2⤵
  - Executes a command shell one-liner
  PID:2872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c /c schtasks /query /tn "Microsoft\Windows\Crypto\CredMon"
  2⤵
  - Executes a command shell one-liner
  PID:2308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c /c schtasks /query /tn "Microsoft\Windows\Crypto\CredMon"
  2⤵
  - Executes a command shell one-liner
  PID:5696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c /c schtasks /query /tn "Microsoft\Windows\Crypto\CredMon"
  2⤵
  - Executes a command shell one-liner
  PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c /c schtasks /query /tn "Microsoft\Windows\Crypto\CredMon"
  2⤵
  - Executes a command shell one-liner
  PID:6108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\Crypto\CredMon" /tr ""C:\Users\Public\Microsoft\Crypto\crdmon.exe"" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1300

C:\Users\Public\Microsoft\Crypto\crdmon.exe
C:\Users\Public\Microsoft\Crypto\crdmon.exe
1⤵
- Executes dropped EXE
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crdmon.exe

Path C:\Users\Public\Microsoft\Crypto\crdmon.exe
Size 343KB
SHA256 f7231b2c7ae9eb3406afebaeafcb142a6867aabd2e316274847f16eba229bde1
MD5 3220158cc726ee2778d885885b44407f
SHA1 ebda375932630a32667c021d7df0856d6056fe72
SHA512 0751d8f8afe68c73aba43135b58fb6efab3802d9b1d47c697d1c5735109e64282e513ac0a20726aa6aec6b460cf92969201ee0eb64139b91bd8c5288ef245a3d
SSDEEP 6144:2H3QGQKcH9h5FlWl57cEOa6DRgJ9G/yJ6iR7HdC6Wv8AK:2XQX+JCDRgJ9J6iR5C6WT
TLSH
T185749D29FBA414F9E67BC17CC9530906EA72BC9A0760ABCF13944A562F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crdmon.log

Path C:\Users\Public\crdmon.log
Size 4KB
SHA256 fa6ad8cebf7b836e0d36a5af4c381871ee634a8238c90ac1b3d3ecee12b5eca0
MD5 f33da871f9e0a536340d8475a6e5ce00
SHA1 6ea14250fade58811f520c8ecfd1f596ab6dda82
SHA512 c88c402acbdab84429b9a8f9f3aed9a3d07fba8674a0306760d93220ba0cf3762ce7453324249321f653cf0f25178cad54349c7d679c7b7f30b81afa5ab6e227
SSDEEP 96:oI2e9z6ku6qQjHmd2AzqWeUqpCiWsCuX7JbV767GVRgiiyZ6fK9myXuwGxK3H:eeJbZnLOnz9Ta57NXNblgSqhaMe9Xva+
TLSH
T112919282605420B7369264C0C1E21FD67AAD3787AAA5DEB2B759034EFD19D5BFC0FD08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads