2c4491fbb1297519c8e2da4522a2466312936919a924244b692799eb30a09958

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_0cf01d1dc904c2e700f471a7606e9ff7_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 193KB
Sample260718-ktf72sev8p
SHA256 2c4491fbb1297519c8e2da4522a2466312936919a924244b692799eb30a09958
MD5 0cf01d1dc904c2e700f471a7606e9ff7
SHA1 379e6ccef63bf5b126b5a77e3b95bf4ad0c0d504
SHA512 02a90dfcdc32c255cf4cb7357a38cbafa4a4df892c6f7f0e6d30c8908e99d96fab0b93c5df5e33e7aa5c967e7124bf3311198bc1857fa27229e5c89f62b53151
SSDEEP 3072:vNmE2eAVWCASx3G5Bfs73p3a3TeshFW/USZGiP7F/4V7mx:8EwWX70t3qeshTdiP7hYm
TLSH
T1D9146B97A2E523F5D5A682398C510606E772F8B70724D6DB07A442752F33DB08E3BB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1068	sc.exe
6008	sc.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1068	5108	2026-07-18_0cf01d1dc904c2e700f471a7606e9ff7_cobalt-strike_icedid_luca-stealer_njrat.exe	90
PID 5108 wrote to memory of 6008	5108	2026-07-18_0cf01d1dc904c2e700f471a7606e9ff7_cobalt-strike_icedid_luca-stealer_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0cf01d1dc904c2e700f471a7606e9ff7_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0cf01d1dc904c2e700f471a7606e9ff7_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SYSTEM32\sc.exe
  sc create Havoc binPath= "C:\Users\Admin\AppData\Local\Temp\Havoc.sys" type= kernel start= demand
  2⤵
  - Launches sc.exe
  PID:1068
- C:\Windows\SYSTEM32\sc.exe
  sc start Havoc
  2⤵
  - Launches sc.exe
  PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads