defendnot | d3e4c871b51a511ecdb29c80c7e90f432ea1595cec1190516606936002c2f834

General

Target
2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 363KB
Sample260923-cl577scc79
SHA256 d3e4c871b51a511ecdb29c80c7e90f432ea1595cec1190516606936002c2f834
MD5 8e5be2e0a2765757d865d7fb8b185ae4
SHA1 6a1f01712917cd7bf612f4573bd5df5f9f494665
SHA512 8e514ebe3ddbc2c72d48d1de0ec8c6bfeea5c82f03bf37502a6a104d889868f4c759bc0ffebe17e13626b12f616b2abdbe57f07fcaf431fb5beb2580bb1e0d92
SSDEEP 3072:4/gnQ3YB7Gie2ZenRB1xOmuO/9K9OuKhPnip7mxxMM8zomhqdlcBRz1i7hLL3HmR:qlS7mxxMM8z3hWcRUUo/7Nz3IiaMC
TLSH
T174845B4AEBA524F5E5BBC038C952651BFD717C964770A78F23904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244ec-31.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4356	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4416	defendnot-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1724	sc.exe
4276	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5108	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	powershell.exe
4356	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeRestorePrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	3048	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4416	4356	powershell.exe	105
PID 4416 wrote to memory of 5108	4416	defendnot-loader.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" create moimoi binPath= "C:\Users\Public\moimoi.sys" type= kernel
1⤵
- Launches sc.exe
PID:1724

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" start moimoi
1⤵
- Launches sc.exe
PID:4276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "C:\Users\Public\defendnot-loader.exe --silent --name 'Virus & threat protection'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Public\defendnot-loader.exe
  "C:\Users\Public\defendnot-loader.exe" --silent --name "Virus & threat protection"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - Executes a command shell one-liner
    PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.tmp

Path C:\Users\Admin\AppData\Local\1.tmp
Size 11KB
SHA256 b1b5f132dd1bd60988033f507a36ffaebeddbd6574712c6dbd5c5f3b3c5addef
MD5 a73ba8ef8bf532dee1f4afaa11990933
SHA1 d0abd869e2a201b4461fdf72b041d6d4f3053229
SHA512 e4c712efab6e044a236c6f4a89cabd9de0799bccd4be2ac412a790350178578e66b4b0d38922090bd72fbb6eef2d58cc240c965f51bd0ba7725ca3816cd99f69
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzPIQBvK79VFI3L:sXX+/DV7k/3AuKRo3L
TLSH
T19D420A5C9EE1B2B4F25703EE3BBF696D132451C71408C884F64C6DE46F4B78C8692B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ifnionzq.bt4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ifnionzq.bt4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

defendnot-loader.exe

Path C:\Users\Public\defendnot-loader.exe
Size 592KB
SHA256 8c3c38781a6e6eb9112b5debfeceaa3c0e9fd20dabf45f3b441ef9926575ba3a
MD5 e547f448b7c0db8f2a5455ad7d70c9d4
SHA1 db10e1083fea3709a1940c662cfe196c149fb640
SHA512 6eaab3b79bb670273643670a8e29831f203b31bd229ab69f3ac085433bc616bfdf0285b146a98d3c16b87fd4ef274976535036ceb3db0541cfc59457dcedec8b
SSDEEP 12288:ZDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBkW:ZDddddddddoChjhw7CYh0lhSMXlnsx
TLSH
T1C9D49D26B7E940F9D1ABC27889930A16EB737C4643616ACF03E44A675F236D05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-51-0x000002CBB3480000-0x000002CBB3483000-memory.dmp

Download

memory/4356-22-0x0000021E783F0000-0x0000021E78400000-memory.dmp

Download

memory/4356-21-0x0000021E783F0000-0x0000021E78400000-memory.dmp

Download

memory/4356-30-0x0000021E783A0000-0x0000021E783C2000-memory.dmp

Download

memory/4356-35-0x0000021E78500000-0x0000021E7871C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads