bbccc0ab770d1b93fd2bc8539bf1dbc8017a19a27cec6d62faa5c05ea6bdb8eb

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 415KB
Sample261024-w3q96afe26
SHA256 bbccc0ab770d1b93fd2bc8539bf1dbc8017a19a27cec6d62faa5c05ea6bdb8eb
MD5 28f393dac9c78d8a72e2758685cac50e
SHA1 7a71f305e1d4d096e56a20e2d96d85246759c383
SHA512 22699efec3e4cd62b16713267312a57bbcf819f3cd000870f851c985f52616b1c62e1b27485389ba389823fbb519ec7e2e7d253ed23b7826d0f67d7da1293e15
SSDEEP 6144:GpyqDP4FRjAyhBQO/kqhXTO/J5OO4Xp4oYRIX1F91mh4++gKvwwd6Rm4:WyqDCBxMqha/kXCIX11m6xvXdGz
TLSH
T1F5947D16E76804FDE277C5788D534906EB72BC4A0360EACF03989A671E276D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads