Overview

overview

3

Static

static

3

2026-10-22...lc.exe

windows10-2004-x64

1

2026-10-22...lc.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc.exe
  • Size 4.8MB
  • Sample261024-c6b5vsft2t
  • SHA256 a25a4659c2614735cee0d15bde9f1cfc30e3daca3a2927a2ec061cc4113e9891
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9f8c3e9b284fc80f09c46fc45ba93242_amadey_cobalt-strike_icedid_njrat_satacom_smoke-loader_stealc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4376

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ZmInternal_802dd47c.dll
        • Path C:\Users\Admin\AppData\Local\Legion\Internal\ZmInternal_802dd47c.dll
        • Size 4.5MB
        • SHA256 802dd47cd1d0faa7fdc45b65fba30034500c252eda5135e75cab0d2a162ac370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        diagnostic.log
        • Path C:\Users\Admin\AppData\Local\Legion\Internal\diagnostic.log
        • Size 657B
        • SHA256 be0185c42753855ea013ce6f70fa4020ee2701267a5e804527e08811716806cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download