Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 778KB
- Sample261017-malpjadx9x
- SHA256 0a1c9e256328368917d6284303cfc38cede87df6312c86b4d7f4a66dd0110b6f
- MD5 a47a3fbbec366a9a9a4c345561dacbd9
- SHA1 e787f25760ff8e774f6ed57b493ffdc350b4bded
- SHA512 57eeb918d0011395193a94f662167d2502c1324a660c29fe74cc2f015f892c9d88d562e0c322549008c067c69728f0ad9e6b24e95f1eac00e634fa5bd1c1d48f
- SSDEEP 12288:vFbmn1JF682U4PjTKcvaJs5RXUirDyzUCbDV/ygvsnjoha4eywMgx40:FmDF681WjecAs5R7rDyzRVjvsnjF4
- TLSH T16F05AF55F2A800FCE07BD175D956BA07EA367809032069DF23E45A693F736E01EBB712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2812 2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_a47a3fbbec366a9a9a4c345561dacbd9_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2812