Overview

overview

7

Static

static

3

2026-10-20...lc.exe

windows10-2004-x64

7

2026-10-20...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 08:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 3.6MB
  • Sample261020-j3d9daxvcs
  • SHA256 03938d1ce90c1bdcbe6ca1ac66e0a28243a82ed9bdc3046724acbcf93b9b4a13
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3596
    • C:\Users\Admin\AppData\Local\Temp\2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc.exe" /speechrt 3596
      2⤵
        PID:3840
    • C:\Users\Admin\AppData\Local\Microsoft\SystemMediaBroker\SystemMediaBroker.exe
      "C:\Users\Admin\AppData\Local\Microsoft\SystemMediaBroker\SystemMediaBroker.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Users\Admin\AppData\Local\Microsoft\SystemMediaBroker\SystemMediaBroker.exe
        "C:\Users\Admin\AppData\Local\Microsoft\SystemMediaBroker\SystemMediaBroker.exe" /speechrt 2508
        2⤵
        • Executes dropped EXE
        PID:5992

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          SystemMediaBroker.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\SystemMediaBroker\SystemMediaBroker.exe
          • Size 3.6MB
          • SHA256 03938d1ce90c1bdcbe6ca1ac66e0a28243a82ed9bdc3046724acbcf93b9b4a13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 689B
          • SHA256 b5c93302387349224dc2ff4fbd683203359871ef61140b45227091ca2b754351
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 697B
          • SHA256 1d746c210254a5617e7966344c68f3c2e531c7552dc1b85c1c4d55f67663dd53
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 778B
          • SHA256 b9d391c8eac2fa159bb2ff82a6efdf827edaf8705ed5bf3f68f4b8a1efec6264
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 794B
          • SHA256 bcc49a952a874302092316f264c939543b18a3156d80790bb14ae52be39867db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 876B
          • SHA256 9de088cc9a842afac2dce3b4fb2c66dd251de8be2b67257893290d1410f19ed1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 955B
          • SHA256 f9c8b27e9e2a5026e7dcf007f6753362fd1a9318e3d72726ba105393192d08fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 129B
          • SHA256 ea7b1e1a225338a09e6c33beb2cdf9468ccc94672ea49a98fc1e897fd37c8a5f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 998B
          • SHA256 a0aba9060cf21d505154ad276f2446c7f3751316f3ae4702ecef8387a0807596
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 b4398fe20dc3232e45c2e13f4cdf69f1d195ad2439af926a88e1cee608b08f53
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 e9df6916f21de90a2cc400d26517ebb9bd25170cbbe9e5413ef197f761afdea3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 163B
          • SHA256 42e73c9d1dfa0b8eb436bfd719e7a2ec4b8650a3f4069f9e60a0eb8d6aa7d868
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 6be3f80cea3d89d3580fd5a3672e56651520732ecad8aa0a5a845b8b7b1d6538
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 e2a5697d89708a3298ee40c5b76f1a0700442381bb201cae2dbaf989ba4c1076
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 1KB
          • SHA256 3536d66cdd699523e9782084db7f02e4c1257725287ec608a34e60a412700ab9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 216B
          • SHA256 c45a9acd08f5b486657302f37ed0b6436ce5fc976694e6f380fe4d3214b0b197
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 121B
          • SHA256 3a19c248b69a2f2e13c99a81b59c975a5ec0666da434d5333eb802931f1fc6e2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 346B
          • SHA256 6d48644e4218b93e2f38c9229118f64c863f211c6773f49c10d67b023f4902c0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 418B
          • SHA256 5bc24ddca1de9d4ba7a9c371c2d14c1798df49b025c81ef3dc53a2d42f24e976
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 452B
          • SHA256 c8d7d87b340364dc70e6a177ff3130f33715e028c3e2a1dd00342be320b5fce1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          arv_boot.txt
          • Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
          • Size 538B
          • SHA256 17f85944bbafa0a2f11b21ed91341e185fda7e8c2a006240ed98969c5b05836e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2508-55-0x00007FF92A260000-0x00007FF92A4C3000-memory.dmp
          Download

          memory/2508-48-0x00007FF92A260000-0x00007FF92A4C3000-memory.dmp
          Download

          memory/2508-131-0x00007FF92A260000-0x00007FF92A4C3000-memory.dmp
          Download

          memory/3596-91-0x000002101F740000-0x000002101F9A3000-memory.dmp
          Download

          memory/3596-11-0x00007FF92A260000-0x00007FF92A4C3000-memory.dmp
          Download

          memory/3596-13-0x000002101DB20000-0x000002101DB21000-memory.dmp
          Download

          memory/3596-12-0x00007FF92A260000-0x00007FF92A4C3000-memory.dmp
          Download

          memory/3596-17-0x00007FF92A261000-0x00007FF92A3CA000-memory.dmp
          Download