Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 16:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 13.8MB
- Sample261024-vazv6aa12w
- SHA256 219b3706be48bf1f3f992e18fe1860ab792de3d691c38197f0839ec92818f782
- MD5 368415b34c2c7ed14790c31159ce1aef
- SHA1 8c355369185bcef762516602cd869bd0195380c3
- SHA512 1ce4333f1113ac56f3b497400c0de40e9bd005667072809bad52ede49963e0c31947b1ad63d2fcb5cadf3ef07901985c25cf09eb8818f9396d9c425ab8b31c43
- SSDEEP 196608:Bm5cls0Digl/+bTMZNt2O2pY8dMXUbWWz+F/8MP/3rZNcA2tiEZ/djFFum/5Sztd:gclVtR+bgMOMtWWz+F0a/9Nh5Eptn/m
- TLSH T127E60247739E57E9C032A4388F01E113FEE2BC041739B2EBE6A189155A276F10E7D766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs
pid Process 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeDebugPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeShutdownPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeDebugPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeShutdownPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeDebugPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeShutdownPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeDebugPrivilege 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4764 2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4764