d07d036052e4fb69a0242aaa41934056e11c040083e2346efcab6f57ba3e1c6e

General

Target
2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 394KB
Sample260504-adc6caat4x
SHA256 d07d036052e4fb69a0242aaa41934056e11c040083e2346efcab6f57ba3e1c6e
MD5 a4222ba7da9c59f44bb29841560c550f
SHA1 f43cfb075ca84fa844eb92ae3e96c3c4ab485720
SHA512 f4f8268f3b1f3ff7d1ac619b7310d7a9f292540bd880509e1e2a2599a93f4d1e9aff9ad0963e46f09de58a7fbe4d7366c69f6f92edc697419e0fcdd3505a0f03
SSDEEP 6144:NITqs9YxPd3iwMmMoS1b6HDvsyBZ2En/9dpZ5/8LrVv/trANmrubDVyDoIN/SvKm:OYxPd3iA1556F/RAK4VyDoIyKuZDuE
TLSH
T1C8846D16E7A410F9E1A7D178CD624906EB727C4A0770E7CF13A84A961F376E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1212	winscreenshot.exe
4556	winscreenshot.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\winscreenshots\winscreenshot.exe	2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\winscreenshots\winscreenshot.exe	2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\BluetoothNotificationAreaIconWindowClass.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\Task Host Window.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\Window.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\MS_WebcheckMonitor.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\BluetoothNotificationAreaIconWindowClass.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\C__Users_Admin_AppData_Local_Temp_2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\Battery Meter.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\keylogs\JWUHOPEY\2026-05-04_01-05-27\keylog.log	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\_fullscreen.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\GDI+ Window (winscreenshot.exe).png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\Microsoft Text Input Application.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\Task Host Window.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\keylogs\JWUHOPEY\2026-05-04_01-05-26\keylog.log	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\GDI+ Window (winscreenshot.exe).png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\Window.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\C__Windows_system32_cmd.exe.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\C__Users_Admin_AppData_Local_Temp_2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-27\Battery Meter.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\_fullscreen.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\Microsoft Text Input Application.png	winscreenshot.exe
File opened for modification	C:\Program Files\winscreenshots\screenshots\JWUHOPEY\2026-05-04_01-05-26\MS_WebcheckMonitor.png	winscreenshot.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1212	1952	2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\winscreenshots\winscreenshot.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-03_a4222ba7da9c59f44bb29841560c550f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1212

C:\Program Files\winscreenshots\winscreenshot.exe
"C:\Program Files\winscreenshots\winscreenshot.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winscreenshot.exe

Path C:\Program Files\winscreenshots\winscreenshot.exe
Size 394KB
SHA256 d07d036052e4fb69a0242aaa41934056e11c040083e2346efcab6f57ba3e1c6e
MD5 a4222ba7da9c59f44bb29841560c550f
SHA1 f43cfb075ca84fa844eb92ae3e96c3c4ab485720
SHA512 f4f8268f3b1f3ff7d1ac619b7310d7a9f292540bd880509e1e2a2599a93f4d1e9aff9ad0963e46f09de58a7fbe4d7366c69f6f92edc697419e0fcdd3505a0f03
SSDEEP 6144:NITqs9YxPd3iwMmMoS1b6HDvsyBZ2En/9dpZ5/8LrVv/trANmrubDVyDoIN/SvKm:OYxPd3iA1556F/RAK4VyDoIyKuZDuE
TLSH
T1C8846D16E7A410F9E1A7D178CD624906EB727C4A0770E7CF13A84A961F376E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing