439b66d6ad3778f0d101093e2ff33055ed447ddc56f0b39e5fe91fd33505e649

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_356f8fdd18e06f59592040ecdd598a0e_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 471KB
Sample260711-vae6raft9k
SHA256 439b66d6ad3778f0d101093e2ff33055ed447ddc56f0b39e5fe91fd33505e649
MD5 356f8fdd18e06f59592040ecdd598a0e
SHA1 2477c9bba1680bc9546674044862362d5e07e6a5
SHA512 87ab8247a773e10a52e0b8af79499539ab6386e38bf40e7509f3f8c720c9379538a666848ccd1a000a15e9e09f7a72ce5522e12a31dceaa8332780f6f47c0d91
SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3l+JXYsYzCm0:qmiMZvN43+u85Bpw+YMRkc9BoJXYJCm0
TLSH
T137A47C19D7E405F9E0B3E578CD938922EB767C494761E68F03E49DA72F232908D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-07-11_356f8fdd18e06f59592040ecdd598a0e_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	mspaint.exe
4196	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4196	mspaint.exe
4196	mspaint.exe
4196	mspaint.exe
4196	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4196	4776	2026-07-11_356f8fdd18e06f59592040ecdd598a0e_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_356f8fdd18e06f59592040ecdd598a0e_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_356f8fdd18e06f59592040ecdd598a0e_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.png
Size 6KB
SHA256 f56524614314c0a7f070143e6bed33462124dc4be485802d589a6c83b2a1a71b
MD5 e8d86af98ca687f17ecab626fd17081e
SHA1 9410e81c30fe54444aa30ac1cdc6b376e8c3de88
SHA512 c5bd3ae084a3d6d2d1b642783f878c7d55519e5d3cd800ba5916a44b9e963821848ab05c08557a6e95816df7d10e35c9c107754a91601a8d5bfcc892d5d0d226
SSDEEP 96:r428dpIo9H8qX9Ry/YXsvzYLXNrF4ZtSVBcsx82+745pIcgrTtuSdOT7JBt8t000:8lpTR8qkYLXNrF4+cQq4oOT77tzAAt
TLSH
T1C9D18EE71219AC9EEBE6D5B1A1C456114C40161035817D7321C2EFBE0B81DF943C7E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download