21847467ddec1a2f01260b664e246b8458ad5ebf0ce2ddadc0f4b70f6bc317f1

Analysis

max time kernel
6s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 15.4MB
Sample260709-cxcp2acz21
SHA256 21847467ddec1a2f01260b664e246b8458ad5ebf0ce2ddadc0f4b70f6bc317f1
MD5 11f0ca2e5b0b125bb9ef7898bb5c8b6d
SHA1 a11f73efda086fba0bb44c670dda3394bc1391df
SHA512 369d53bb3275c5baf7c8cdd9c6085a2023b7bf4f489caa7d3c165e4ba4124f4ee0f188c89f8609337531fb906b3dd43c8757609efd3b5443207d75391cd8a43e
SSDEEP 196608:97Kg7PAmkeEyg7PAmkeErfzujx8YyLoQK2Z:RPAmkeEzPAmkeE3uij7
TLSH
T130F64AE730C267EDC516C93E8713FEBF868F7035062699F3A068E2665D26C843E55E09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4740	reg.exe
1468	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	shutdown.exe
Token: SeRemoteShutdownPrivilege	4336	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3548	PickerHost.exe
5888	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 1192	6032	2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 1192 wrote to memory of 4740	1192	cmd.exe	90
PID 6032 wrote to memory of 5992	6032	2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 5992 wrote to memory of 1468	5992	cmd.exe	92
PID 6032 wrote to memory of 2868	6032	2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 2868 wrote to memory of 4336	2868	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\CI\Config /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\CI\Config /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "Enabled" /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\shutdown.exe
    shutdown -s -t 3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4336

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3548

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6032-0-0x00007FF669AF0000-0x00007FF66AA60000-memory.dmp

Download

memory/6032-1-0x00007FF669AF0000-0x00007FF66AA60000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads