6f0da3b8fe25cfb1aa3976130fc5fd4abdce3a881fdca573ecd3b142d4d10869

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 611KB
Sample260913-nc8grafq21
SHA256 6f0da3b8fe25cfb1aa3976130fc5fd4abdce3a881fdca573ecd3b142d4d10869
MD5 b2bad7e17702c7a19c514f1c1252ddfc
SHA1 96c50ea01c6e01b74f714bc4fa518fe9a15a6ea0
SHA512 5156e217b3e4abbf7c9d0ac34a5bca2fdd4874e7fadff2cc36e5bdc877a68ee400b74f593a9523432ffe5c5ddff42b0b8adf4f32852b40d1dfdf8e82fb1856f5
SSDEEP 6144:3AkKRI6rVLKXt6BHztxtOHjnPeyl0Uf+xshdH8LkTLZSWtJwvooULJ3802jSQ:KRtLKXt6nCnPep8t3gooULu0zQ
TLSH
T141D4AE1BA3688CEAD253A23D8951E709D6707E810721D7CB63B1099B7F23BD19E3D790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5992	powershell.exe
5992	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5992	powershell.exe
5992	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5992	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4440	2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5992	4440	2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_b2bad7e17702c7a19c514f1c1252ddfc_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\di'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_oih3sbjp.d1v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oih3sbjp.d1v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Network.exe

Path C:\Users\Admin\AppData\Local\di\downloads\Network.exe
Size 100KB
SHA256 82a982f298e3bb8df2f83dbdeb06cdebd9c710ab014a7ebfe5eb3a9a60ccf335
MD5 368c9926e73a77c87fdeadc051bc14f5
SHA1 3550767ac458402828fa11cb1b2902457feb7199
SHA512 6887d5d817b5965319adb93df52330bfe8bb10eddd09a8b5ba5ce20aed0dfc2dda143adfa8b4ccb3a00ab04c04cbcd45ab1fee1ce6ba7ed51a2276d4d5e35183
SSDEEP 3072:bJ2VOzyqhqZ6KiWO0ihSB2zBncr0jB+d1iZ8VY7:bJuUyqqZ4foYzyr0j8rvVY7
TLSH
T141A3129F2287C18D711B2D943E6BDC39899954E9913890382EF963AE2782C75EF35C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5992-31-0x00000147C0CD0000-0x00000147C0CE0000-memory.dmp

Download

memory/5992-30-0x00000147C0CD0000-0x00000147C0CE0000-memory.dmp

Download

memory/5992-39-0x00000147C2F80000-0x00000147C2FA2000-memory.dmp

Download