692a1f25296e011ebeef4e6ccf3ce76587459d1ddb0b55001434efe2abe869e1

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 11:42

Target
2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 299KB
Sample260707-nvcsssgz2w
SHA256 692a1f25296e011ebeef4e6ccf3ce76587459d1ddb0b55001434efe2abe869e1
MD5 e06d1d26cbdead6d9366a04316939a2b
SHA1 38ad6b946bf184bdf986ab2bae43e4ac2ed6958f
SHA512 b0fc468a550f534d86b33a33720b04b86f7a809f9ecbf73d7897792a93cfdc141081ad71b7ed91c02fe4987d7c4573b544df1e339032a92f3b9c18cd798a1053
SSDEEP 3072:K9rszQIT9KgrZ+9AO7AjpvPjDbqcuQfQkMXvSEIotmLx+5GObRaOQa8jWZ+WdMSc:K9jITv+9mlDbLNfE1QNioLkhKb/R
TLSH
T124547D1AE7A514F9E977823CCD524906EB727C5647A1EBCF03A04A963F236D08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"	2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2416	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1980	4844	2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	86
PID 4844 wrote to memory of 2416	4844	2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "MicrosoftEdgeUpdateTask" >nul 2>&1
  2⤵
  PID:1980
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2416

C:\Users\Admin\AppData\Local\Temp\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-07_e06d1d26cbdead6d9366a04316939a2b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1⤵
PID:3144