Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
- Size 1.0MB
- Sample260721-c3vssset2v
- SHA256 e2464a17a2335f71af3cc042afe31617b95f6b54c5c83917b30bf16b3d9a67ab
- MD5 70cb86dee0c2dc5c09808d3d0dd392b8
- SHA1 22487bd5ffef8cd1ab542c476ec6fd3ab7c8640a
- SHA512 2568edde7400b2bff59e4f05ecaacf91e4278a2f07118b8dd67260047e0f8057e84e3679caab7238747b1577e01debc056e7715709714ad68c8f32792b53cd8e
- SSDEEP 12288:DHeiWvD3RJvcQ66EBScJUYorq5odOaS3Cv3JTvYXsHnNk+iYLkublWGM2AcwRmWP:DCaUYEqGdyi5UX4nSrJH2s
- TLSH T11135AF0FFE4231EDC24AD8B49756C9939921398A0735A9FB4FE502722A766E05F3CF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\ = "URL:bdekjscfwq Protocol" 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\URL Protocol 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\shell 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\shell\open 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\shell\open\command 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\"" 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\bdekjscfwq 2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_70cb86dee0c2dc5c09808d3d0dd392b8_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"1⤵
- Modifies registry class
PID:1132