Overview

overview

4

Static

static

1

2026-07-10...at.exe

windows10-2004-x64

4

2026-07-10...at.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_d37cfb1cb1c263db90cdb2e7e5bd6274_cobalt-strike_icedid_luca-stealer_njrat.exe
  • Size 853KB
  • Sample260710-vsj8esfx8t
  • SHA256 7aceabe1d34f95cd8750fdaf3a650027db9d59e17b973e42d06e48c5e3c85d08
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_d37cfb1cb1c263db90cdb2e7e5bd6274_cobalt-strike_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_d37cfb1cb1c263db90cdb2e7e5bd6274_cobalt-strike_icedid_luca-stealer_njrat.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4672
  • C:\Program Files\SAN Health Support Link\SANHealth.exe
    "C:\Program Files\SAN Health Support Link\SANHealth.exe"
    1⤵
    • Executes dropped EXE
    PID:2860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SANHealth.exe
        • Path C:\Program Files\SAN Health Support Link\SANHealth.exe
        • Size 524KB
        • SHA256 ada6283e02033f022802fbc2a2d7c74f6c4cf53ddb44e173a9f3b7a5c345eb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WeOnlyDo.Client.SSH.dll
        • Path C:\Program Files\SAN Health Support Link\WeOnlyDo.Client.SSH.dll
        • Size 381KB
        • SHA256 22d88e8c169898e72c545ed4ad3accb8d8418277fb640ec46570c91696c2a229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Readme.txt
        • Path C:\Users\Admin\AppData\Local\Temp\4A5959C5\Readme.txt
        • Size 2KB
        • SHA256 6e011a61ad8aaa79c68b1e37621a27455b6349652f9a3b99a1e01353c2d7ccbb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Setup.ico
        • Path C:\Users\Admin\AppData\Local\Temp\4A5959C5\Setup.ico
        • Size 4KB
        • SHA256 0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetupExe.$$$
        • Path C:\Users\Admin\AppData\Local\Temp\4A5959C5\SetupExe.$$$
        • Size 520KB
        • SHA256 faa35b67bb0250f079e1fa2edb4b84e3f6ebbc1be8fc256d71cdefbad2750689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2860-41-0x000002386E2F0000-0x000002386E354000-memory.dmp
        Download

        memory/2860-39-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-38-0x000002386B9A0000-0x000002386BA24000-memory.dmp
        Download

        memory/2860-36-0x00007FFEA52FF000-0x00007FFEA5300000-memory.dmp
        Download

        memory/2860-42-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-43-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-44-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-45-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-46-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-47-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-48-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-49-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download

        memory/2860-50-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
        Download