Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 03:35
General
- Target 2026-09-29_2f88005df9aa03336b72316a253725ac_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 11.4MB
- Sample260930-d5fbkazses
- SHA256 5ac87626220b06722433703a28f0320f7dbc8c77dbd15e6815613c7a53cb3bea
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f88005df9aa03336b72316a253725ac_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f88005df9aa03336b72316a253725ac_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4160-0-0x00007FF767200000-0x00007FF767D78000-memory.dmp
memory/4160-4-0x0000029824A10000-0x0000029824A11000-memory.dmp
memory/4160-19-0x0000029824B20000-0x0000029824B21000-memory.dmp
memory/4160-18-0x0000029824B10000-0x0000029824B11000-memory.dmp
memory/4160-17-0x0000029824AF0000-0x0000029824AF1000-memory.dmp
memory/4160-16-0x0000029824AE0000-0x0000029824AE1000-memory.dmp
memory/4160-15-0x0000029824AD0000-0x0000029824AD1000-memory.dmp
memory/4160-14-0x0000029824AC0000-0x0000029824AC1000-memory.dmp
memory/4160-13-0x0000029824AB0000-0x0000029824AB1000-memory.dmp
memory/4160-12-0x0000029824AA0000-0x0000029824AA1000-memory.dmp
memory/4160-11-0x0000029824A90000-0x0000029824A91000-memory.dmp
memory/4160-10-0x0000029824A80000-0x0000029824A81000-memory.dmp
memory/4160-9-0x0000029824A70000-0x0000029824A71000-memory.dmp
memory/4160-8-0x0000029824A60000-0x0000029824A61000-memory.dmp
memory/4160-7-0x0000029824A40000-0x0000029824A41000-memory.dmp
memory/4160-6-0x0000029824A30000-0x0000029824A31000-memory.dmp
memory/4160-5-0x0000029824A20000-0x0000029824A21000-memory.dmp
memory/4160-3-0x0000029824A00000-0x0000029824A01000-memory.dmp
memory/4160-2-0x00000298249E0000-0x00000298249E1000-memory.dmp
memory/4160-1-0x00000298249D0000-0x00000298249D1000-memory.dmp