24725f98fbe5db218ab6b489450bb3abfd654e858299fbd463a4ea8d023bd92d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 06:02

Target
2026-05-03_a9fb4d209a94b884c96b60df53079d04_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 141KB
Sample260503-grnmkact2t
SHA256 24725f98fbe5db218ab6b489450bb3abfd654e858299fbd463a4ea8d023bd92d
MD5 a9fb4d209a94b884c96b60df53079d04
SHA1 aa980e76c72ba15c66a3a8c9a71ce351285acc90
SHA512 82b826995a18cc6d26ec9a9b8f30bf6e8bc3017a521cc2b356fc53b49f804ed2b34c3affa4ba18af43dc019229c145fda79007545533c92b07c2610204825055
SSDEEP 3072:Z2UCsIJx4Vmyvi3CePl4q4HfDxfYrcgHJWA:ZF0aVmXp4q4/Dxs4A
TLSH
T17BE35B17B3A630F9E1B78239C8610646F7B2B87207619B9F039447762F276D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4692 created 4156	4692	2026-05-03_a9fb4d209a94b884c96b60df53079d04_cobalt-strike_icedid_luca-stealer_njrat.exe	81

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 5940	4692	2026-05-03_a9fb4d209a94b884c96b60df53079d04_cobalt-strike_icedid_luca-stealer_njrat.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-03_a9fb4d209a94b884c96b60df53079d04_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a9fb4d209a94b884c96b60df53079d04_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\winver.exe
  C:\Windows\system32\winver.exe
  2⤵
  PID:2772
- C:\Windows\system32\ComputerDefaults.exe
  C:\Windows\system32\ComputerDefaults.exe
  2⤵
  PID:4156
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "c:\Users\pc\Desktop\ua\admin_test.bat"
    3⤵
    PID:5940