ba6d8d9914db320fb890be140292ad455d9ee0314f8df8f21405c0330601c899

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-08_6df165df31fcfb9f33b478861ff971e8_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 743KB
Sample260508-2bkk7ae161
SHA256 ba6d8d9914db320fb890be140292ad455d9ee0314f8df8f21405c0330601c899
MD5 6df165df31fcfb9f33b478861ff971e8
SHA1 feb23be8c348758e40a4d884a54db9e4d8b3be8a
SHA512 46e22da89abe08da1d1122bcb5a1ccba0839da1dc6eec2925e0948fa4d0893a8917aa1e3d0966c844c85e13a77b958d5970c632ce5c9eb6ad5cb02d075872f5e
SSDEEP 12288:cRZeGAfqNGA3Uq29XIDixjpyq0BAfUf3zCU2dD819t4x8ICrP:cRSfrAEH9XIYpj0BAfUuvQTv1P
TLSH
T185F4AE05F7A601B9D1B7D674C946C963E732F84D0B61E78F03E1B9A61E27A90CD3A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	auto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2388	1208	2026-05-08_6df165df31fcfb9f33b478861ff971e8_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-08_6df165df31fcfb9f33b478861ff971e8_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_6df165df31fcfb9f33b478861ff971e8_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\auto.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\auto.exe"
  2⤵
  - Executes dropped EXE
  PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auto.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\auto.exe
Size 33KB
SHA256 2391bb4d0586f3bd93446e231decda1dabc311248f6b7e1282353a0032f28ce0
MD5 e33f10dbf64cf83327478a067d0f8596
SHA1 02b7eb58e225694eacf9f1045cfa84c36915f3d8
SHA512 ba84f39f326d49b1493fee3fa5777e8dae9eccad2985efd083a5088515a46a480466606f2766ab99d8d3f35705ff626714ef9b35b73c9c7623a26b443afb7ad8
SSDEEP 768:3d1tAjVc3Mho4+JF7oIjm4RoMz1QB6SrMf:KD+P7oIjm451QowMf
TLSH
T1F7E23B017BD9C67BE3AE4A7C8DF1510643FDE5A32903E78E2C9410F709237C68A116E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-14-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/2388-15-0x000000001BF90000-0x000000001BFA0000-memory.dmp

Download

memory/2388-16-0x0000000001020000-0x000000000102C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads