f5bf386266cbfdafd3a3c0ca133ec9c6559fbf23b2cc39304fd23130b2c951f6

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:47

Target
2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 623KB
Sample261102-s8dpgabs5t
SHA256 f5bf386266cbfdafd3a3c0ca133ec9c6559fbf23b2cc39304fd23130b2c951f6
MD5 87e80122314822b67a7a111e892edce2
SHA1 7850d282e3e86abb8e9ee046ca6c28db8e0f6b49
SHA512 a2b16c347d3434f66a39cb1af28a3be7e24e13a3decbb480abb486868a373b4d9dce78fee467c8d6d1ac4e7fa045b03b9b8a4653f05cf457649f13bc6bde573f
SSDEEP 12288:L0HCsX9qB5avihoDFx9qMG3Ys1vtFJm+:GtUraKhoJx9lGos116+
TLSH
T11CD47D56EBA403F8D17BC1B4CA828956EB76F815433456CB03E24A635F376A05B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4608

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact