Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 17:15
General
- Target 2026-10-19_6c80a0e055c13ea20e5f2247e8aa5256_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 333KB
- Sample261020-vs2gpscv6y
- SHA256 6846afacae88353ba6fac819ab461ffab2b7791cfb00c5f7f1bc32f94f67afb3
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_6c80a0e055c13ea20e5f2247e8aa5256_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_6c80a0e055c13ea20e5f2247e8aa5256_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\_470482965\DefService.exeC:\Users\Admin\AppData\Local\Programs\_470482965\DefService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
upload[2].json
DefService.exe
Uninstall.xml
fedaspnet_counters.dll
memory/720-245-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-248-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-247-0x0000027AC4BF0000-0x0000027AC4C4D000-memory.dmp
memory/720-243-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-246-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-244-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-242-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-253-0x0000027AC4C90000-0x0000027AC4D3F000-memory.dmp
memory/720-249-0x0000027AC4C90000-0x0000027AC4D3F000-memory.dmp
memory/720-257-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-258-0x0000000140000000-0x0000000140063000-memory.dmp
memory/720-259-0x0000000140000000-0x0000000140063000-memory.dmp