21e406a1068746c097d2b3a154c1a269dc36193eaa22f958ca9b4fa21938de0a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_f80f2d098679ecfbc9730e3537c1cd80_cobalt-strike_icedid_ryuk.exe
Size 108KB
Sample260719-y9fhcaev21
SHA256 21e406a1068746c097d2b3a154c1a269dc36193eaa22f958ca9b4fa21938de0a
MD5 f80f2d098679ecfbc9730e3537c1cd80
SHA1 6b80f25642e91ce0d80b84c378fb583ba5fdaa6d
SHA512 f1164e30f7b5ac07f46845e1fb4a2577d3fe10d4c5bfb276179c382fd58c8601e205e56e8340e761b209d55bfcbcb2db2355964d61eb32bcedf8ffd1aacda720
SSDEEP 3072:RuZByi8Epy52TZg3S7JJIDZDwJMuUpxsA:Rayi8Bq0S7JJItM2F
TLSH
T1D7B34A5762E530F9E177823885614A05E773B83287A19FEF07A842AA1F237D09D3DF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-19_f80f2d098679ecfbc9730e3537c1cd80_cobalt-strike_icedid_ryuk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-19_f80f2d098679ecfbc9730e3537c1cd80_cobalt-strike_icedid_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_f80f2d098679ecfbc9730e3537c1cd80_cobalt-strike_icedid_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f80f2d098679ecfbc9730e3537c1cd80_cobalt-strike_icedid_ryuk.exe"
1⤵
- Checks processor information in registry
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads