0a1952a283adae747d0b02481c34c178ec0095183dfe9653f1e0631933e6cec6

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 446KB
Sample261017-mlf87aed55
SHA256 0a1952a283adae747d0b02481c34c178ec0095183dfe9653f1e0631933e6cec6
MD5 a18c3aac2e79f731655692dd30b55da4
SHA1 7bc000a1ce6fedc9b0412058ed52f00e3196209c
SHA512 0332990336b50a62bd27fb11bcc9b44fc00725e9dc05322be086da775572dc09df9584d2a5fbfc0b5e197ac84644f28de60e06590f0da3ce18aca1b040ba4fe6
SSDEEP 6144:wlTNGsqrKVs4RGY+Z9Mny6++6OCHvoB2z5WTaMLOJFmrLExdW1+KeIRUso:28KVs4RX+7MnV++6Prz5WTFLOJuoxCzo
TLSH
T1AAA43A0692A901BCE0BBA3789D575D02E77A780A03B19ADF03D0D5762E677D09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3092	SyncService.exe
4524	SyncService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync_08E78319 = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SyncServices\\SyncService.exe\""	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{4A8F3653-659B-43C3-B686-D72398BC8C3D}	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{4A8F3653-659B-43C3-B686-D72398BC8C3D}\State_9FE46441 = c46229d11028d64854cf5675f66421f46dc97edf2539c0ff6b872f425c06332b8a528e108295d287589d66c32b3f4cf77bd92cdd97d400b861d9093e77989024b0418dfdbb6f4edc01295c8391417401dfd27d97b419c43d06dc8d31d5b69f670c88f5f273268ad9e40acd0db7df875eae2e6fe8964a643eea7da01cf35b8493c3f3bccd26a110c702e619cbc36fc30d675d521d9508e1a7fecb654d2b0d702200266a4a27a77a0c1f504ead36d7211ac4fb3d85d974c4663decdaee4185678a71e19f59de42ed75fcc7468d910e286039da7a61483e60fe03dade42429d502734f351eaf67bace64de8cca12ae03ef0ce26892c2d39f06e71036440a66852d6942de55a778555244c25fb08b16ef17f72f762023841c9986ffc51e9fb094465dd2cea511312fab76c89ddb7cfb6a57a2ab82f7aa4451a	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2876	2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_a18c3aac2e79f731655692dd30b55da4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2876

C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
"C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe"
1⤵
- Executes dropped EXE
PID:3092

C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
1⤵
- Executes dropped EXE
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SyncService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\SyncServices\SyncService.exe
Size 446KB
SHA256 721fcf656f80ecf8cd004046ff5d937ff17c69ba8df3562b527bb482c80b7ad7
MD5 94a3f79a3ba7bbd42c28db4797d09780
SHA1 8d9937bf32202ee6161d955228a0dbde71852da0
SHA512 749e252e558aaa33b617936cf7a88601125f4950f65a61c5489ae13571a4c043145d2cc2c6eb014092ffb8bb07e04947ea12b9d3ff5010087fb77326bff38795
SSDEEP 6144:wlTNGsqrKVs4RGY+Z9Mny6++6OCHvoB2z5WTaMLOJFmrLExdW1+KeIRUsn:28KVs4RX+7MnV++6Prz5WTFLOJuoxCzn
TLSH
T1E8A43A0692E901BCE0BBA3789D575D02E77A780A03B19ADF03D0D5762E677D09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download