4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291

Analysis

max time kernel
76s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 11:43

Reason

Machine shutdown

Target
2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe
Size 261KB
Sample260710-nvpscsby2x
SHA256 4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291
MD5 7d26da31bce134024f73cbc571b93d04
SHA1 40e350334dc454573012be05597a35429d835e26
SHA512 f092cbc04df00ddd1821b3da8864a9bad4dbd2cf9ccac51a4d04b29f23de7fb0b25ed2aacd60bb75222a5295a68cb5121aed5e74ef784b7a7250f6553320216e
SSDEEP 3072:Qb4h2T68Vaoz+O0q3fkBnuTGglb74rTTPWAUtzfSDOQvRIzPGdkE2dr+aHr5oY4k:Qe2T69P8sB+vIWmD2oadrNohb0jPYU
TLSH
T11B44D021F2D48CDAED76053C5C91A1083A767C84CB35DD3B05A4C76B8EE72A4AD2DDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	whoami.exe
Token: SeShutdownPrivilege	4660	shutdown.exe
Token: SeRemoteShutdownPrivilege	4660	shutdown.exe
Token: SeShutdownPrivilege	1332	shutdown.exe
Token: SeRemoteShutdownPrivilege	1332	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6068	PickerHost.exe
1748	LogonUI.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4424	1224	2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe	89
PID 1224 wrote to memory of 4908	1224	2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe	90
PID 4908 wrote to memory of 4864	4908	cmd.exe	91
PID 4908 wrote to memory of 4660	4908	cmd.exe	92
PID 4908 wrote to memory of 1332	4908	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Windows\system32\shutdown.exe
    shutdown -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\shutdown.exe
    shutdown /s /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1276

memory/1224-0-0x0000000140000000-0x000000014004A000-memory.dmp

Download

memory/1224-1-0x0000000140000000-0x000000014004A000-memory.dmp

Download