2ea2bafd5b0a0a4898bc55f419ce22448e2bfc17e9b0b440234739fa90babd50

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_1a50542727995b98f68fb27c0023bb1c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 692KB
Sample260925-rfkrmszw9m
SHA256 2ea2bafd5b0a0a4898bc55f419ce22448e2bfc17e9b0b440234739fa90babd50
MD5 1a50542727995b98f68fb27c0023bb1c
SHA1 a7a16c25bfe1decf8c524de1cd69bc830a3dbf9e
SHA512 4fdb1d2c59881e0ad470118524190230a9b498c2766ce5b2afadcda4b2820d5a19046e24ebc17b05556f84acbc7b7619ef6a144209cc2da66cadcf1faa7fce3c
SSDEEP 12288:FNGG3U3ITEmUbqLELvxsrAXq/VU5IcVEsZOLF:1AIAmUbqoLhoP
TLSH
T16EE4E115EBA810F9E277817CCD638606EA727C960770D7CF23A489562F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-09-24_1a50542727995b98f68fb27c0023bb1c_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1a50542727995b98f68fb27c0023bb1c_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x000001428A430000-0x000001428A5FA000-memory.dmp

Download