ef03a17597f3a1d45e526587d4fa3df0947418432bff8a2ae17c69896a5fbbeb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 305KB
Sample260707-jjwdjscy21
SHA256 ef03a17597f3a1d45e526587d4fa3df0947418432bff8a2ae17c69896a5fbbeb
MD5 81f77a1cc82222cc91d29d826bdf67a0
SHA1 f46ba1a5058d5703ebf79b6cdb4fd892505fe57f
SHA512 27386fce5095592b90e0ddfd15a2c62961e2f7848dde9c26c8dda90bf99d5b46f88ba8974576dca4cd37130ae54437254d06819b3b27b929877f7facab75cd6f
SSDEEP 6144:npcbXGf/t7xMXJYJreOhtw8rlxB6J36VV4L//FMAgFh7X/G:pcb2f17iSreOMCbB6J36VS//FNg77X/G
TLSH
T19C646CCA2661E0E2F2E34533F916D7B493317C21CBD056AB02D17A223D3AB81DE1B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1464	ozxod.exe
1708	ozxod.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IiikvRKjhkHV = "C:\\Users\\Public\\h33m4175hdy\\ozxod.exe"	ozxod.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3512	5096	2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat.exe	86
PID 3512 wrote to memory of 1464	3512	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Public\h33m4175hdy\run.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Public\h33m4175hdy\ozxod.exe
    "ozxod.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1464

C:\Users\Public\h33m4175hdy\ozxod.exe
C:\Users\Public\h33m4175hdy\ozxod.exe
1⤵
- Executes dropped EXE
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

acgetl.dat

Path C:\Users\Public\h33m4175hdy\acgetl.dat
Size 5KB
SHA256 b0f18d8befe1f62639464f38a08bf40b0d6e456010434b8335fdefb48c341967
MD5 dc945cac96e753aed185e49ac2b3ddad
SHA1 1c24a7f132c0e1c83e7abdf35240eb4395e02624
SHA512 dc140ca15470d8be530bc887fc7f1af92a965b2278c5e9b916cbf85d62300f1b4c7be6876081973c55b171f913e01d8664dcf97ac9c990f4f64a845238f67e5b
SSDEEP 96:/gT5O8tztxv+284kuXIuUVtmkgJxc7DWkQDAhRKyARoSP7zFwFzT4Q7VuZrgLBoF:/JatzVMuUXmklvQ8hRKykzof7VWrgzUJ
TLSH
T11AC18D5E1D491A742FE939878626186C21C2B21904CCEAF375E6F90FB03AC3E36E7056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ozxod.exe

Path C:\Users\Public\h33m4175hdy\ozxod.exe
Size 111KB
SHA256 2794534c56cb303f25332fb6c5a4df27fe26e2bf0b63500365bb921a9d99375b
MD5 b1897a3aef76533f6f99c8664ceb9e95
SHA1 a6552b9644e15553e58d260e7ef88716c35d02c4
SHA512 7d55dade49c98f992c97ce6158599988f542f2dfe399a8064f00f7cf85b8c8184843a75a2f5b2fad8c9b7c48a8613d43a9a4ac2719a11e0f0102b8ba24a6a2db
SSDEEP 3072:2R5aD2WW85B5Ks8Y6uhAxYwA7ydlywAd/Z:l6WWFsB6uCxumlyP1Z
TLSH
T175B36B6B73A530F8E4B78638C4A11A09D772B8320761AFEF07A446561F236D58D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.cmd

Path C:\Users\Public\h33m4175hdy\run.cmd
Size 95B
SHA256 5fea35dddd4f5de94e5ec3201edb4b67213643ee0f435777cc1f3e658c5f1cc3
MD5 e30229024690cd0aeb018386be4027ab
SHA1 3a94b35a9e62b1f7fc8381c9eef667807c682fe9
SHA512 66909649cf415035a306deab97064f3117f6c14b8b6466eecda2784fee978c5fcd3d71647eaee6d96aae1e251d96a1af81ffdfdaecdeffc96c707a06bd010ba2
TLSH
T101B01209280410562618488B466D30076A4902864000A74103D5047D140BD7925D74E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-9-0x000001B9ADF90000-0x000001B9ADF92000-memory.dmp

Download

memory/1464-10-0x000001B9ADF90000-0x000001B9ADF92000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads