Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 22:28
General
- Target 2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 348KB
- Sample261104-2dpypaf18p
- SHA256 c32c4cd2fb954b4cae66dcc7305519fc2af2ed04fc9b75cf8248ffa609330fef
Malware Config
Signatures
- Family: Azov
A wiper seeking only damage, first seen in 2022.
- Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\Desktop','C:\Users\Admin\Documents' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\loot_b7e981200cacb22facef.zip' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qp0ktc2q.ejz.psm1
loot_b7e981200cacb22facef.zip
BlockRestore.cr2.locked
CompareAssert.tmp.locked
CompressReceive.mpeg.locked
RESTORE_FILES.txt
memory/3332-15-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-18-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-13-0x000001CD2AB60000-0x000001CD2AC12000-memory.dmp
memory/3332-12-0x000001CD2AB40000-0x000001CD2AB5E000-memory.dmp
memory/3332-8-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-14-0x000001CD2AC20000-0x000001CD2AC2A000-memory.dmp
memory/3332-0-0x00007FFB8794F000-0x00007FFB87950000-memory.dmp
memory/3332-16-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-17-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-9-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-19-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-21-0x000001CD2AB40000-0x000001CD2AB4A000-memory.dmp
memory/3332-20-0x000001CD2AC30000-0x000001CD2AC42000-memory.dmp
memory/3332-25-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-7-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-6-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-5-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-4-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
memory/3332-3-0x000001CD2AA90000-0x000001CD2AAB2000-memory.dmp