Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 09:11
General
- Target 2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 363KB
- Sample260922-k5439ace49
- SHA256 4e50a6ebcb9234532c71567074c83dc843e0259f844da6a4df0a65afea7809fa
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Creates new service(s) 2 TTPs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create moimoi binPath= "C:\Users\Public\moimoi.sys" type= kernel1⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start moimoi1⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "C:\Users\Public\defendnot-loader.exe --silent --name 'Virus & threat protection'"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1656-33-0x0000017AD8430000-0x0000017AD8433000-memory.dmp
memory/4584-18-0x00007FFA3EA1F000-0x00007FFA3EA20000-memory.dmp
memory/4584-21-0x000001276DAD0000-0x000001276DAF2000-memory.dmp
memory/4584-22-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
memory/4584-23-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
memory/4584-24-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp
memory/4584-26-0x00007FFA3E890000-0x00007FFA3F234000-memory.dmp