Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 13:04
General
- Target 2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 6.0MB
- Sample260922-qa75bafa48
- SHA256 350ba422422af7ea41f4602225dad4edf0bffcf36d6548adbc29186983b9f3d2
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\argus_update_85CFA921E7A94F47.exe"C:\Users\Admin\AppData\Local\Temp\argus_update_85CFA921E7A94F47.exe" --apply-update "C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe" 45642⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_5969ea6f0abd75845e7285bb467eccc8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
argus_update_85CFA921E7A94F47.exe
memory/2732-5-0x00007FFF02B30000-0x00007FFF02B32000-memory.dmp
memory/2732-6-0x00007FFF02B40000-0x00007FFF02B42000-memory.dmp
memory/2732-7-0x00007FFF02B50000-0x00007FFF02B52000-memory.dmp
memory/2732-8-0x00007FFF02B60000-0x00007FFF02B62000-memory.dmp
memory/2732-9-0x00007FFF00C70000-0x00007FFF00C72000-memory.dmp
memory/2732-10-0x00007FFF00C80000-0x00007FFF00C82000-memory.dmp
memory/2732-11-0x00007FFF00740000-0x00007FFF00742000-memory.dmp
memory/2732-12-0x00007FFF00750000-0x00007FFF00752000-memory.dmp
memory/2732-13-0x00007FF650D00000-0x00007FF652FA5000-memory.dmp
memory/2732-18-0x00000290AE5F0000-0x00000290AE6C3000-memory.dmp
memory/2828-19-0x00007FFF02B30000-0x00007FFF02B32000-memory.dmp
memory/2828-20-0x00007FFF02B40000-0x00007FFF02B42000-memory.dmp
memory/2828-21-0x00007FFF02B50000-0x00007FFF02B52000-memory.dmp
memory/2828-22-0x00007FFF02B60000-0x00007FFF02B62000-memory.dmp
memory/2828-23-0x00007FFF00C70000-0x00007FFF00C72000-memory.dmp
memory/2828-24-0x00007FFF00C80000-0x00007FFF00C82000-memory.dmp
memory/2828-25-0x00007FFF00740000-0x00007FFF00742000-memory.dmp
memory/2828-26-0x00007FFF00750000-0x00007FFF00752000-memory.dmp
memory/2828-27-0x00007FF698A60000-0x00007FF69AD05000-memory.dmp
memory/2828-31-0x000001F977D30000-0x000001F977E03000-memory.dmp