4ccbe2d2b2d41a877508564be99961e0afbcf40340394d619514b12c92c79772

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 4.0MB
Sample261003-xd41dsvekb
SHA256 4ccbe2d2b2d41a877508564be99961e0afbcf40340394d619514b12c92c79772
MD5 e51bc63b9e4f9c672f9db494c78585fc
SHA1 1c373592299a8aa6c4af8b524ec040b9b76079f5
SHA512 f7c782dcbf1ae48873c71cbaabc5429550e09c9ad2427b6de119dba7b18e5a435b23bb9dd7cbfff3d45f40c3401e743fb11975cce5978ffdff7eb2e6c6bcda3d
SSDEEP 49152:2jOyhhOsIMazojRWson6ln/9feIlJQ7zrSfcbAwQ309GjlgGiM6/I84RUSan6Nvb:ShLIIlmwF0GxgHAh+Gjx
TLSH
T14716BF12F3A542ECC12B9138D656AB1BF331784507206BDB23E41E556FA7AE01FBE391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3336	2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads