Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/09/2026, 13:04
General
- Target 2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 6.0MB
- Sample260922-qa75bafa48
- SHA256 350ba422422af7ea41f4602225dad4edf0bffcf36d6548adbc29186983b9f3d2
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\argus_update_3FD01E2673874092.exe"C:\Users\Admin\AppData\Local\Temp\argus_update_3FD01E2673874092.exe" --apply-update "C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe" 7802⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
argus_update_3FD01E2673874092.exe
memory/3236-5-0x00007FF71DE62000-0x00007FF71EB73000-memory.dmp
memory/3236-8-0x00007FF951870000-0x00007FF951872000-memory.dmp
memory/3236-7-0x00007FF951860000-0x00007FF951862000-memory.dmp
memory/3236-6-0x00007FF951850000-0x00007FF951852000-memory.dmp
memory/3236-11-0x00007FF94FBA0000-0x00007FF94FBA2000-memory.dmp
memory/3236-10-0x00007FF94FB90000-0x00007FF94FB92000-memory.dmp
memory/3236-9-0x00007FF951880000-0x00007FF951882000-memory.dmp
memory/3236-13-0x00007FF94F050000-0x00007FF94F052000-memory.dmp
memory/3236-12-0x00007FF94F040000-0x00007FF94F042000-memory.dmp
memory/3236-14-0x00007FF71DCF0000-0x00007FF71FF95000-memory.dmp
memory/3236-21-0x00007FF71DE62000-0x00007FF71EB73000-memory.dmp
memory/3920-23-0x00007FF951850000-0x00007FF951852000-memory.dmp
memory/3920-24-0x00007FF951860000-0x00007FF951862000-memory.dmp
memory/3920-25-0x00007FF951870000-0x00007FF951872000-memory.dmp
memory/3920-26-0x00007FF951880000-0x00007FF951882000-memory.dmp
memory/3920-28-0x00007FF94FBA0000-0x00007FF94FBA2000-memory.dmp
memory/3920-27-0x00007FF94FB90000-0x00007FF94FB92000-memory.dmp
memory/3920-29-0x00007FF94F040000-0x00007FF94F042000-memory.dmp
memory/3920-30-0x00007FF94F050000-0x00007FF94F052000-memory.dmp
memory/3920-31-0x00007FF72A0B0000-0x00007FF72C355000-memory.dmp