Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 288KB
- Sample260716-l93xesd17z
- SHA256 be3d0cfa5436c4cd0b1c8d922bb50c47a0899836ee7136960e5d31e3c4755e32
- MD5 67c097938460ecdce2757ab4914e116e
- SHA1 c8d30af1c7ca97602b4b67a78bc71338a9e03bce
- SHA512 bb988ec90978db983ccb7752773b88e1d79f7519ced4c8a59689880f6df53c35fe0d4cc0396b92089f4c2064e291a0c68ddf459436564ad89b97157ce24ea031
- SSDEEP 6144:ucCmg4KmTRVd/9ewxVwaTS/XSrQEOJWdNE:EqPd/ww3FTSkQwE
- TLSH T12C547D1AE7A515FDE9A7C17DCD814D02EB72BC460760EADF079009A22F276E05E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Token: SeRestorePrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Token: SeTakeOwnershipPrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Token: SeSecurityPrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Token: SeLoadDriverPrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Token: SeDebugPrivilege 4396 2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_67c097938460ecdce2757ab4914e116e_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4396