af97fd89540da859f63b772800437a06ce27873c281ae00590d487e440de0a3e

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 934KB
Sample260710-ft7msaex2y
SHA256 af97fd89540da859f63b772800437a06ce27873c281ae00590d487e440de0a3e
MD5 98f2c49123eb2a7fdfe807fe5b932ad7
SHA1 f019d3a375217fc79d9e791a0ace697a1cb1e985
SHA512 c062eaecffba3b568486fb30f1f3161ad29a780f3558b5b83370d0a8392037b93156f691744578a99ff7666f2168893a17ae70e66e72bef2bb68fd3f45382fb0
SSDEEP 12288:GhoVY2+LfWvRSECKG4iRkTwkkLRCAhtYuNVbewyu5HO:ab2+CvRSEHiRkTwkkztYuNVbeP4HO
TLSH
T1BA155A4C5BE4CFABFBEED834B842195692F76C8A929C95F7C2405B613D43BACD219700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	mspaint.exe
1488	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1488	mspaint.exe
1488	mspaint.exe
1488	mspaint.exe
1488	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1488	3296	2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1616c21d32b694a71349d84d935cb158.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1616c21d32b694a71349d84d935cb158.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1616c21d32b694a71349d84d935cb158.png
Size 50KB
SHA256 5d3c4d27c7662f8675b35ca1d87d0512d7f2e5b2042b3d6b34ff13f3c4942d35
MD5 bab93e12660b6b8c5aa720c48c92238a
SHA1 529c86091f78197c1d983c6329a35b548cdbff67
SHA512 3b2ef50a786b5dcc297e309a83d1cc2cc7a2c19927a41c90c54a852342699b2aa0d68bab4a4060cb01aa854c0cf44cf4ae2be9c5b8e76909ef0844a0c1846985
SSDEEP 1536:FVGggAP2sYAsMBaX/tzcAvzzUdh3i5dgK/:gKNmX/tzKiZ/
TLSH
T18A3301E9F3106713F85ECEB3C1AC19E1F4868526EC6EE1DF9442DC947602132EA8A569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download