e0a72ca464049c528575738e011b6c0fbafd7d5246916191f282aa1cb3466dd3

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_5c62ec5baed7961b26dad8cab6056518_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 638KB
Sample260705-mawvhaby21
SHA256 e0a72ca464049c528575738e011b6c0fbafd7d5246916191f282aa1cb3466dd3
MD5 5c62ec5baed7961b26dad8cab6056518
SHA1 39501433227d4479cd2aee0bd94434553b6e899a
SHA512 88758a9549aecbc0ec33db85abfb9ded9cf34da91ca5e6af54153cf5c144f32fb08beb3cab65cd29f9f5f9a79d06258356a57546c53f5917a071d0c33ae25d52
SSDEEP 12288:kciZ4qN4ZkKdcLtmUzG8G4e9ED7V02wd+OCPnCW4HlbJZ:z25kkKdcLt08I927V02MqfCW+/Z
TLSH
T101D4BE19D7F404FCE1B7E178CD938912E7767C494761E68F03E499A62F232909E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000_Classes\Local Settings	2026-07-05_5c62ec5baed7961b26dad8cab6056518_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5500	mspaint.exe
5500	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5500	mspaint.exe
5500	mspaint.exe
5500	mspaint.exe
5500	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6388 wrote to memory of 5500	6388	2026-07-05_5c62ec5baed7961b26dad8cab6056518_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c62ec5baed7961b26dad8cab6056518_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c62ec5baed7961b26dad8cab6056518_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6388
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\clickme.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clickme.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\clickme.png
Size 190KB
SHA256 5ce0e77de3e9e8446c362a294fcd5a9b4520a7b26f8b5d8236e570804e4a4574
MD5 a91d8cc1502eb810bf0ee68060d88336
SHA1 b9d25e38da3c16c7dea3400aba0ba8c5b92af21d
SHA512 47216381d8d6138d2973ffd33581917f0611064310c720aab58365e49638799820d183acf34acd78dfbe0489b573befb861cca0349bd21949fc55fb20003f6c5
SSDEEP 3072:ALs0RuLcv22DGbqmBsPkMEqOnX97IIIiQ17Xk2cZT9W0WRam9wfi/dgAmBwaQjWr:AtmB2cqZ8MzJIS1j5ypW0WpN/d5mHVJ
TLSH
T1D81412E252EBDCF3C9116AF0B1704CC87DBE12DDA1E84478B895B5A4B4983675308EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download