4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 15.8MB
Sample260922-3d95ashg49
SHA256 4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3
MD5 f66e854cfcd34bf0a26a2514babb0cbd
SHA1 12c1daac7c8584ab1fb5dd853e38dd7f652b5b82
SHA512 9c0294f2199c0e8996df1fdef96f390fb48756e235ea9f539c6ada0a13c74f2a5b2e81b9cad62f6ac4f7b728877a3eb21e303f7c6c7a29907385b9d6346f567e
SSDEEP 196608:K1cnk0blImIujKHo869Ts/KU2Sz0hGVLhpK2ftfWiwRQjX:nnk0blSksnFz0hGZhpK2luhO
TLSH
T1C0F69D45F2A251E8D57BC038C266A617FB7038BD43146AF79AD19A646F23BD06E3F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe"	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe
2748	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{5E5C1867-C228-47A9-885D-E9834BE196BF}	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	powershell.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeIncreaseQuotaPrivilege	2748	powershell.exe
Token: SeSecurityPrivilege	2748	powershell.exe
Token: SeTakeOwnershipPrivilege	2748	powershell.exe
Token: SeLoadDriverPrivilege	2748	powershell.exe
Token: SeSystemProfilePrivilege	2748	powershell.exe
Token: SeSystemtimePrivilege	2748	powershell.exe
Token: SeProfSingleProcessPrivilege	2748	powershell.exe
Token: SeIncBasePriorityPrivilege	2748	powershell.exe
Token: SeCreatePagefilePrivilege	2748	powershell.exe
Token: SeBackupPrivilege	2748	powershell.exe
Token: SeRestorePrivilege	2748	powershell.exe
Token: SeShutdownPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeSystemEnvironmentPrivilege	2748	powershell.exe
Token: SeRemoteShutdownPrivilege	2748	powershell.exe
Token: SeUndockPrivilege	2748	powershell.exe
Token: SeManageVolumePrivilege	2748	powershell.exe
Token: 33	2748	powershell.exe
Token: 34	2748	powershell.exe
Token: 35	2748	powershell.exe
Token: 36	2748	powershell.exe
Token: SeIncreaseQuotaPrivilege	2748	powershell.exe
Token: SeSecurityPrivilege	2748	powershell.exe
Token: SeTakeOwnershipPrivilege	2748	powershell.exe
Token: SeLoadDriverPrivilege	2748	powershell.exe
Token: SeSystemProfilePrivilege	2748	powershell.exe
Token: SeSystemtimePrivilege	2748	powershell.exe
Token: SeProfSingleProcessPrivilege	2748	powershell.exe
Token: SeIncBasePriorityPrivilege	2748	powershell.exe
Token: SeCreatePagefilePrivilege	2748	powershell.exe
Token: SeBackupPrivilege	2748	powershell.exe
Token: SeRestorePrivilege	2748	powershell.exe
Token: SeShutdownPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeSystemEnvironmentPrivilege	2748	powershell.exe
Token: SeRemoteShutdownPrivilege	2748	powershell.exe
Token: SeUndockPrivilege	2748	powershell.exe
Token: SeManageVolumePrivilege	2748	powershell.exe
Token: 33	2748	powershell.exe
Token: 34	2748	powershell.exe
Token: 35	2748	powershell.exe
Token: 36	2748	powershell.exe
Token: 33	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeIncBasePriorityPrivilege	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: 33	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeIncBasePriorityPrivilege	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: 33	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeIncBasePriorityPrivilege	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: 33	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeIncBasePriorityPrivilege	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2748	4136	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe	89

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748