defendnot | d3e4c871b51a511ecdb29c80c7e90f432ea1595cec1190516606936002c2f834

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 363KB
Sample260923-cl577scc79
SHA256 d3e4c871b51a511ecdb29c80c7e90f432ea1595cec1190516606936002c2f834
MD5 8e5be2e0a2765757d865d7fb8b185ae4
SHA1 6a1f01712917cd7bf612f4573bd5df5f9f494665
SHA512 8e514ebe3ddbc2c72d48d1de0ec8c6bfeea5c82f03bf37502a6a104d889868f4c759bc0ffebe17e13626b12f616b2abdbe57f07fcaf431fb5beb2580bb1e0d92
SSDEEP 3072:4/gnQ3YB7Gie2ZenRB1xOmuO/9K9OuKhPnip7mxxMM8zomhqdlcBRz1i7hLL3HmR:qlS7mxxMM8z3hWcRUUo/7Nz3IiaMC
TLSH
T174845B4AEBA524F5E5BBC038C952651BFD717C964770A78F23904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c535-30.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2436	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1280	defendnot-loader.exe
1072	defendnot-loader.exe

Loads dropped DLL 2 IoCs

pid	Process
5652	Taskmgr.exe
5656	Taskmgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\defendnot	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3796	sc.exe
3196	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1520	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	powershell.exe
2436	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeRestorePrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeRestorePrivilege	2088	2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1280	2436	powershell.exe	97
PID 1280 wrote to memory of 5652	1280	defendnot-loader.exe	98
PID 1072 wrote to memory of 5656	1072	defendnot-loader.exe	102
PID 1072 wrote to memory of 1520	1072	defendnot-loader.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_8e5be2e0a2765757d865d7fb8b185ae4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Downloads MZ/PE file
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" create moimoi binPath= "C:\Users\Public\moimoi.sys" type= kernel
1⤵
- Launches sc.exe
PID:3796

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" start moimoi
1⤵
- Launches sc.exe
PID:3196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "C:\Users\Public\defendnot-loader.exe --silent --name 'Virus & threat protection'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Public\defendnot-loader.exe
  "C:\Users\Public\defendnot-loader.exe" --silent --name "Virus & threat protection"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\Taskmgr.exe
    Taskmgr.exe
    3⤵
    - Loads dropped DLL
    PID:5652

C:\Users\Public\defendnot-loader.exe
C:\Users\Public\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:1520

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctx.bin

Path C:\Users\Public\ctx.bin
Size 131B
SHA256 bbb6a8dcd2c0d76f294efaa3ba4e1b9eb2045607805b9164195c47002409388c
MD5 0a0d0ed88afd608243f4358c4c00ebf0
SHA1 b7a5aa7938c2b11effec4768642fa891d54f8f55
SHA512 fdcd455b7a1df12ce7b1e192c75c2283e4a28d645462f2560d6ee8ed027ab680d6f4c49f459bd193b570c755c222e2d80bc3bbac8ab8392481e9cb5e08bd379d
MD5 SHA1 SHA512

Submit Download

ctx.bin

Path C:\Users\Public\ctx.bin
Size 131B
SHA256 5d7f018ddd2e052e2816d42ab6e1f204fd5103954102d574c6128b32fc8d56ef
MD5 555d91c31e323915b09acd85b167d656
SHA1 fbf73cc606eb4d9d89a443e9c8906fb3878bacd0
SHA512 15f5759ab5cf22f1f24316b63ee1b17987f34a7aa2217537d595bac7cc2cd619a122f53637c4d4aa10c5fb84a0a6c19475e85037f15e3d7bdbd2e7fd1d697134
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Users\Public\defendnot-loader.exe
Size 592KB
SHA256 8c3c38781a6e6eb9112b5debfeceaa3c0e9fd20dabf45f3b441ef9926575ba3a
MD5 e547f448b7c0db8f2a5455ad7d70c9d4
SHA1 db10e1083fea3709a1940c662cfe196c149fb640
SHA512 6eaab3b79bb670273643670a8e29831f203b31bd229ab69f3ac085433bc616bfdf0285b146a98d3c16b87fd4ef274976535036ceb3db0541cfc59457dcedec8b
SSDEEP 12288:ZDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBkW:ZDddddddddoChjhw7CYh0lhSMXlnsx
TLSH
T1C9D49D26B7E940F9D1ABC27889930A16EB737C4643616ACF03E44A675F236D05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Users\Public\defendnot.dll
Size 438KB
SHA256 fa22d1c85039afbd975fae663c9d4f325b606edc9b49f5842c1434da7ce7a641
MD5 ad2bcf22090bc955f317e6bf4b3f59a4
SHA1 d8d1572450ca2a43d507e9a794738780e7a399ff
SHA512 de096d8acdb7a8ed710a5280c49abc96e72932978e82d3f3a0b421172ac3160ef79a9e55a4d793749f3a4b901a0463c436505fbd123fee451d8b68f3103f2308
SSDEEP 6144:tuax4l7odwsjYGT5Zeu14MPQEPa6/ph0lhSMXlBXBWniG77mHBRc:tppTzn1bZa6/ph0lhSMXliV3J
TLSH
T13194BE16B7A580B9E16B8278C8970A05EB337C414791EBCF03A4DAB66F637D15B3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-54-0x0000013589220000-0x0000013589223000-memory.dmp

Download

memory/2436-23-0x00007FFD3431F000-0x00007FFD34320000-memory.dmp

Download

memory/2436-24-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp

Download

memory/2436-27-0x0000020FADAD0000-0x0000020FADAF2000-memory.dmp

Download

memory/2436-28-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp

Download

memory/2436-29-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp

Download

memory/2436-35-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp

Download

memory/2436-34-0x00007FFD34190000-0x00007FFD34B34000-memory.dmp

Download