Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 00:58
General
- Target 2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
- Size 5.3MB
- Sample261027-bb1z3azzaz
- SHA256 436f39734d455443ebeb567114237e5f3de28f2280cd5498a663d9d7793d0e21
Malware Config
Signatures
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAIAAkAE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAIAAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAHAAIAA9ACAARwBlAHQALQBBAHAAcAB4AFAAYQBjAGsAYQBnAGUAIAAtAE4AYQBtAGUAIAAnAGQAZQB2AC4AbABvAGMAYQBsAC4AMgAwADIANgAtADEAMAAtADIANgAuAGYAZQA2ADkAOABjAGYAYwBmADEANAA1AGEAZQAxADQAYQA4ADMANgA2AGUAMgBiADUANgBjADEAZgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAOwAgAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHAAKQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACgAJABwAC4AUABhAGMAawBhAGcAZQBGAGEAbQBpAGwAeQBOAGEAbQBlACAAKwAgACcAfABAAHwAJwAgACsAIAAkAHAALgBQAGEAYwBrAGEAZwBlAEYAdQBsAGwATgBhAG0AZQApACAAfQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAIAAkAE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAIAAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAHAAIAA9ACAARwBlAHQALQBBAHAAcAB4AFAAYQBjAGsAYQBnAGUAIAAtAE4AYQBtAGUAIAAnAGQAZQB2AC4AbABvAGMAYQBsAC4AMgAwADIANgAtADEAMAAtADIANgAuAGYAZQA2ADkAOABjAGYAYwBmADEANAA1AGEAZQAxADQAYQA4ADMANgA2AGUAMgBiADUANgBjADEAZgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAOwAgAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHAAKQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACgAJABwAC4AUABhAGMAawBhAGcAZQBGAGEAbQBpAGwAeQBOAGEAbQBlACAAKwAgACcAfABAAHwAJwAgACsAIAAkAHAALgBQAGEAYwBrAGEAZwBlAEYAdQBsAGwATgBhAG0AZQApACAAfQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.ini
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.log
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.log
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.log
2026-10-26_fe698cfcf145ae14a8366e2b56c1fdf0_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.log
AppxManifest.xml
__PSScriptPolicyTest_pzgpjcvi.ms1.ps1
memory/6116-65-0x000002B6298E0000-0x000002B6298F0000-memory.dmp
memory/6116-75-0x000002B644200000-0x000002B64420A000-memory.dmp
memory/6116-76-0x000002B644280000-0x000002B6442A6000-memory.dmp
memory/6116-74-0x000002B6441E0000-0x000002B6441F6000-memory.dmp
memory/6116-71-0x000002B643C00000-0x000002B643C22000-memory.dmp
memory/6116-64-0x000002B6298E0000-0x000002B6298F0000-memory.dmp