Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260706-en
1 signatures
150 seconds
General
- Target 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
- Size 1.0MB
- Sample260707-hyd75sb19s
- SHA256 3512456cfc4a470c702b99797db59f7bc0d1774cbee31a9a3b95d963ad38ad75
- MD5 c1e5d90356776ecaeaf323d38d03156e
- SHA1 33f60837b472efe3aec5310988836435c09ffcaf
- SHA512 bae447e6179c17c2b09382b3e10e17aa859bf3d4cfa8f760972e13717be6499f4cd2e3fded69d0105e9987a7aa8e3f15204774eed8bf9369799ea1f3228351b5
- SSDEEP 24576:+EIqY5ZEGLFI+CqOPZMyVTggKciVh4wr9:+EIqYrxLFItZVCbh79
- TLSH T1C335AE1FFE8631EDC24AC8B49356C9939921358A0735AAEB4FE412712A75BE05F3CF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\URL Protocol 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\shell 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\shell\open 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\shell\open\command 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\"" 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\xqdfrvzfl\ = "URL:xqdfrvzfl Protocol" 2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_c1e5d90356776ecaeaf323d38d03156e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"1⤵
- Modifies registry class
PID:2040