3e9f8a4d6744cb714c22d27899f0370a7c74477e759217ae2e94e7f44e31a73e

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 1.0MB
Sample260705-bcxc9sfx7v
SHA256 3e9f8a4d6744cb714c22d27899f0370a7c74477e759217ae2e94e7f44e31a73e
MD5 fd443a8c9048d3ba847266423d66efe5
SHA1 f18109852b9861a79e8b94ce0a0195be81dbfa27
SHA512 862041e9a5f9dd33d6213924a9fed2ef01decdc08171e7f9517c4fe4e6f2103466fa26199458a8fe478af4cf0e917698ce57262d7e25787c869d84e3ff9afd7e
SSDEEP 12288:TMUK5HTDRzJN6UG8BLRkKb97ixM7/L+G3FxS3qLAh9DvmToyEC3eFv3UV1RmAQjs:TMJ51XwgyG3VL8vxSul3MfmLpx/8
TLSH
T1F835AF1FFE8670EDC24AC9B49356C993992135CA0735A9EB4FE402712A76AE05F3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\ = "URL:zmyzcixj Protocol"	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\URL Protocol	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\shell	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\shell\open	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\shell\open\command	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\""	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\zmyzcixj	2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_fd443a8c9048d3ba847266423d66efe5_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Modifies registry class
PID:6344

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads