Overview

overview

6

Static

static

3

2026-09-24...om.exe

windows10-2004-x64

6

2026-09-24...om.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 20:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe
  • Size 367KB
  • Sample260924-yvmccaha98
  • SHA256 073918cdb86aa2532ac27c05779122c917cd0851eece68d1e8e407b6237a6b8a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: LoadsDriver 7 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Adds Run key to start application
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "nlhwL6yb" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe" /sc onlogon /ru SYSTEM /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:6036
  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-24_dea96b0c6c9c11a763580e336e7d61f8_cobalt-strike_icedid_njrat_satacom.exe
    1⤵
      PID:5732

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 222B
          • SHA256 433ba8588313acb82e4f0641d10605c955b01f59ec75479e3fa745d38446958e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 244B
          • SHA256 6a1fc4a90f8e452f0b9f23a1a1a9c07225e45003258e7ea175afe37b8c72805c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 268B
          • SHA256 71c6b7808e55be35965bd1b4031dbfa33f132afb4289b58d8a2907590f5faeec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 129B
          • SHA256 e0cb86bdabf7bab25c83835d3fc5e1e66f6e6b49768f829f8fd1b1bf55867b47
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 177B
          • SHA256 ea5f2e5299ff7eddaed598e816e976eb23870e171b76b63cdfa7448b9e3f2687
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          worm_debug.log
          • Path C:\Users\Admin\AppData\Local\Temp\worm_debug.log
          • Size 195B
          • SHA256 3f2aefb993dd4490f379004ef5e6d89b2339a86e191d68ba7237aee0175a9df9
          • MD5 SHA1 SHA512 TLSH
          Submit Download