e836969268126336d1dd113414753112d682e4eda7aa1281b8ec873e581a7696 | Triage™

Login
Reports

Overview

overview

Static

static

2026-07-27...lc.exe

windows10-2004-x64

2026-07-27...lc.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_f26869a51b02f014f505ef8baee0c9a4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 808KB
Sample260727-c537ysvsg1
SHA256 e836969268126336d1dd113414753112d682e4eda7aa1281b8ec873e581a7696
MD5 f26869a51b02f014f505ef8baee0c9a4
SHA1 56281927f3bda0089280aac27d554d06b3b261e7
SHA512 cec4f3bdc317ebe349ceffaff1ebb6978edae9e8f8747fc2f66a034e2f5d96de1c2ccd9b39a305e89a3cc497a4db87fb75ce0b2c85f8ebfe830ad163d68c2ab2
SSDEEP 12288:8jfdcdNPcwhfOTgdgKvCQ5Q9V3HWfez7tjg8XLqO:GmdNPVhOmgKvt5Qr3fz7tj5p
TLSH
T1C5058E2E7B5802F4E1B6D27489561446F7B27C0A5330DADF27E846E62F23AE05E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-07-27_f26869a51b02f014f505ef8baee0c9a4_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

21 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware trojan

Behavioral task

behavioral2

Sample

2026-07-27_f26869a51b02f014f505ef8baee0c9a4_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

21 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Targets

- Target
  2026-07-27_f26869a51b02f014f505ef8baee0c9a4_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 808KB
- SHA256 e836969268126336d1dd113414753112d682e4eda7aa1281b8ec873e581a7696
- MD5 f26869a51b02f014f505ef8baee0c9a4
- SHA1 56281927f3bda0089280aac27d554d06b3b261e7
- SHA512 cec4f3bdc317ebe349ceffaff1ebb6978edae9e8f8747fc2f66a034e2f5d96de1c2ccd9b39a305e89a3cc497a4db87fb75ce0b2c85f8ebfe830ad163d68c2ab2
- SSDEEP 12288:8jfdcdNPcwhfOTgdgKvCQ5Q9V3HWfez7tjg8XLqO:GmdNPVhOmgKvt5Qr3fz7tj5p
- TLSH
  T1C5058E2E7B5802F4E1B6D27489561446F7B27C0A5330DADF27E846E62F23AE05E3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution impact persistence ransomware trojan
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Scheduled Task/Job

Scheduled Task

Windows Management Instrumentation

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Scheduled Task/Job

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Direct Volume Access

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Windows Event Logs

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

behavioral2

defense_evasionevasionexecutionimpactpersistenceransomwaretrojan

© 2018-2026

Terms | Privacy