Overview

overview

7

Static

static

3

2026-10-18...lc.exe

windows10-2004-x64

7

2026-10-18...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 14:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 3.6MB
  • Sample261018-rlt79sys6r
  • SHA256 aaaf69e4e0b4a182534ba40660b6bba498157a21b2f879b0c927f0932029c379
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\AppData\Local\Temp\2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc.exe" /speechrt 3708
      2⤵
        PID:1208
    • C:\Users\Admin\AppData\Local\Microsoft\MicrosoftSpeechHost\MicrosoftSpeechHost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftSpeechHost\MicrosoftSpeechHost.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Users\Admin\AppData\Local\Microsoft\MicrosoftSpeechHost\MicrosoftSpeechHost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftSpeechHost\MicrosoftSpeechHost.exe" /speechrt 4692
        2⤵
        • Executes dropped EXE
        PID:1264

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MicrosoftSpeechHost.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\MicrosoftSpeechHost\MicrosoftSpeechHost.exe
          • Size 3.6MB
          • SHA256 aaaf69e4e0b4a182534ba40660b6bba498157a21b2f879b0c927f0932029c379
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 617B
          • SHA256 6208f5c095c8c815db100cd2c477e4187ef3ebc4d6e3fb6a63d44eeccbec046f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 715B
          • SHA256 646abec7588b608d0ad95b6d4ca0756ae91d7d6df35e136bd3dac6632541734b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 778B
          • SHA256 007744c5a7409ea71093e075c033fc273e350bf23805200d29ced970e99f7376
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 794B
          • SHA256 a3391f5c33a37f83021abc9bc34d42303fe1e581b6452053f9b0d884e8c98715
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 821B
          • SHA256 5ae726d6c50bee4b19c32f87538c1e0a9961fabd8cd7e75636a0466e193e668a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 892B
          • SHA256 a5ec97257fe3c2debad0ed1dde8b5a7c7cd9c927ae39af1aea9ae25bf7da52da
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 955B
          • SHA256 f19403b71320f9ec15015280777a089e514b78614d3864b420063c7fa2951abd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 971B
          • SHA256 264a544a566dcdaf519a57d8b9a657af34db171570a41b6924f85311dafdcce2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1020B
          • SHA256 f6b0cb58c3a85b278a80f84d1463616e2c899c6717e1c2ef01e2cb247e7fe2ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 5778df8e5ff5fb6aeea80e068a60a62a50a9bf26c829b821008e97962640c7e7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 163B
          • SHA256 9163eeeeed445126ffac2951bc74454b70730f710f0d4eed991b9aea1fb5e335
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 80931885945b1c6ab1c75c5b1da6f3f81d5c280b425a91ec8180cff5a6f86701
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 d34b15db25f982d7643d8a7e07cbe758695e1bb651956ca60e1b2a7bc2f75c3f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 496c12f13c1efdd7a08c0a1ce1ca598cf45a8aa229103e6c61feef5f947d6c4a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 209B
          • SHA256 d7bafe7b622a803caca1e4aa4137a772f7f11357de0ad97f78cc12e44cce1f7b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 121B
          • SHA256 a771eaa655860b57b6a344ed56a6c4766bb6ac9059c2ba1c6d0ad8edfadd2d22
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 308B
          • SHA256 00aea4a299e592ab59fb8ca7dec4c923ee45847ad25c7dea1f665e7edc55f9be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 346B
          • SHA256 c2a678960014d15e844d98528b4eca05b84594360f098c310c158558d1529019
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 399B
          • SHA256 4655c6685be8dddfee051b99b9598a29baf819c2923b81e17628bb5757ca691b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 428B
          • SHA256 ed3cf4f87a667c4954be779870054a6f9fb8b484836066e4f28918063666fa68
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 452B
          • SHA256 118050db524aa60983e54910b90d06ed6f9b0252e78d8a99ff3e1b550e8b0b88
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 538B
          • SHA256 29f02ac4c1c24e0f9356b375b79165af9945477a6f4c61b788905584e540e82f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3708-17-0x000001E3A61A0000-0x000001E3A61A1000-memory.dmp
          Download

          memory/3708-15-0x00007FFA921D0000-0x00007FFA923C5000-memory.dmp
          Download

          memory/4692-130-0x0000013CDE270000-0x0000013CDE465000-memory.dmp
          Download

          memory/4692-54-0x00007FFA921D0000-0x00007FFA923C5000-memory.dmp
          Download