4b32770f025cc3e95862a3df2d5bd48fcda624ef25c5c59aeb9851b55f5eca07

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 397KB
Sample260705-3d871ab15m
SHA256 4b32770f025cc3e95862a3df2d5bd48fcda624ef25c5c59aeb9851b55f5eca07
MD5 5f14fd8b770e43b446e7499a37b9114e
SHA1 0c0c0647f17f21f577f3997524561ff2a96ee1ae
SHA512 279538618c715bfc0cc302022b0c1a58ab4b25652c21ae8cc69242f76d88bd7c017489394422a07145bd1f467517a35b0f21c8c22753b59da195b171f1303721
SSDEEP 6144:rStAqUBm3NSnTMKLWdpi9kbS4u2zbHOLFKVH2v46EHC:rSCqUBVMwt47LPuwstEH
TLSH
T1FB848D69FAA400F9D1A7D53CCD524502EA727C9E47B0DADF13E84A621F276E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4276	wevtutil.exe
Token: SeBackupPrivilege	4276	wevtutil.exe
Token: SeSecurityPrivilege	2568	wevtutil.exe
Token: SeBackupPrivilege	2568	wevtutil.exe
Token: SeSecurityPrivilege	4852	wevtutil.exe
Token: SeBackupPrivilege	4852	wevtutil.exe
Token: SeSecurityPrivilege	4512	wevtutil.exe
Token: SeBackupPrivilege	4512	wevtutil.exe
Token: SeSecurityPrivilege	2844	wevtutil.exe
Token: SeBackupPrivilege	2844	wevtutil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2376	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 3816 wrote to memory of 5920	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 5920 wrote to memory of 4276	5920	cmd.exe	92
PID 3816 wrote to memory of 3476	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	93
PID 3476 wrote to memory of 2568	3476	cmd.exe	95
PID 3816 wrote to memory of 1928	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	96
PID 1928 wrote to memory of 4852	1928	cmd.exe	98
PID 3816 wrote to memory of 4800	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	99
PID 4800 wrote to memory of 4512	4800	cmd.exe	101
PID 3816 wrote to memory of 4316	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	102
PID 4316 wrote to memory of 2844	4316	cmd.exe	104
PID 3816 wrote to memory of 2596	3816	2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wevtutil qe System /q:"*[System[Provider[@Name='Microsoft-Windows-Kernel-Power'] and (EventID=1 or EventID=42 or EventID=107 or EventID=41)]]" /c:100 /rd:true /f:xml 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil qe System /q:"*[System[Provider[@Name='Microsoft-Windows-Kernel-Power'] and (EventID=1 or EventID=42 or EventID=107 or EventID=41)]]" /c:100 /rd:true /f:xml
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=10]]" /c:200000 /rd:true /f:xml 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\wevtutil.exe
    wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=10]]" /c:200000 /rd:true /f:xml
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=8]]" /c:50000 /rd:true /f:xml 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\system32\wevtutil.exe
    wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=8]]" /c:50000 /rd:true /f:xml
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=17]]" /c:50000 /rd:true /f:xml 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=17]]" /c:50000 /rd:true /f:xml
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=22]]" /c:50000 /rd:true /f:xml 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil qe Microsoft-Windows-Sysmon/Operational /q:"*[System[EventID=22]]" /c:50000 /rd:true /f:xml
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hollows_hunter64.exe" /report "C:\Users\Admin\Desktop\HollowsReport" 2>&1
  2⤵
  PID:2596

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads