Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 22:28
General
- Target 2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 348KB
- Sample261104-2dpypaf18p
- SHA256 c32c4cd2fb954b4cae66dcc7305519fc2af2ed04fc9b75cf8248ffa609330fef
Malware Config
Signatures
- Family: Azov
A wiper seeking only damage, first seen in 2022.
- Renames multiple (138) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops desktop.ini file(s) 9 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\Desktop','C:\Users\Admin\Documents' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\loot_7119a745b92abe83b01f.zip' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_v0ugiywk.w3g.ps1
loot_7119a745b92abe83b01f.zip
AddResize.sql.locked
CheckpointEnable.xps.locked
CloseJoin.DVR-MS.locked
RESTORE_FILES.txt
memory/4356-0-0x000001BAF6B90000-0x000001BAF6BA0000-memory.dmp
memory/4356-1-0x000001BAF6C50000-0x000001BAF6C72000-memory.dmp
memory/4356-9-0x000001BAF6B90000-0x000001BAF6BA0000-memory.dmp
memory/4356-11-0x000001BAF9D80000-0x000001BAF9D8A000-memory.dmp
memory/4356-10-0x000001BAF9DA0000-0x000001BAF9DB2000-memory.dmp