Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 1.7MB
- Sample261029-xtqspset2s
- SHA256 b989d61df6f4cf1f7552f91d613b388e0c197785f80aec1e34ef5fd6a70813b6
- MD5 c4b9cb5107ee23de52602f7fd51fbd72
- SHA1 7fd88d5e255320374c4ba624f72315bf0dfc6a63
- SHA512 93d53aeb317bb7bc13f0b7d1356bd1389894954ab7d210bfd57740b80dffaaeb45c58f04df0903896dd4dd70c3a5cc67b46d124d2fd4af4da48ce5893cbf2ebc
- SSDEEP 24576:YOIRTeeqytlWovm2QFYH5ZGuvxI+of5xbcoFXX8ZEWBoVIbxfyQ:hoTe/ytlWoehYH50W8DYoXX82WBoeV
- TLSH T15F85F155A0B824F7C0AAD1B8C1579552F237B8605332AED753D4CAA31F235E06F3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 0 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 1 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeCreateTokenPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeAssignPrimaryTokenPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeLockMemoryPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeIncreaseQuotaPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeMachineAccountPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeTcbPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeSecurityPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeLoadDriverPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeSystemProfilePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeSystemtimePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeProfSingleProcessPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeIncBasePriorityPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeCreatePagefilePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeCreatePermanentPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeBackupPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeRestorePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeShutdownPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeDebugPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeAuditPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeSystemEnvironmentPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeChangeNotifyPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeRemoteShutdownPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeUndockPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeSyncAgentPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeEnableDelegationPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeManageVolumePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeImpersonatePrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: SeCreateGlobalPrivilege 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 31 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 32 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 33 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 34 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe Token: 35 3904 2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b9cb5107ee23de52602f7fd51fbd72_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904