23fedea2e75a97a9c15fd29e06b16b38e009c3e8bbbe7eee5efcd86113826202

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 16:12

Target
2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 874KB
Sample260728-tntevscl7t
SHA256 23fedea2e75a97a9c15fd29e06b16b38e009c3e8bbbe7eee5efcd86113826202
MD5 2038dc6c87295e3338337a95837eb033
SHA1 45abc7d0ec1070343eb8346339135f8b64c3336f
SHA512 188d3ae621047c461dcf0c8395d6f912ad65dc7d92dfd3c258da0eda571adb407bbdb2c3d5ce9ea3c589b21e9d01188eacd77ccd59344b919982287ce672c311
SSDEEP 12288:Qw1DJUVVY4ra/1GbNDXoNZ45eTzwBjJMyUXi1Tvs0Wn0jN1LCvC66KkX8fM8spty:/1DS7atyFXoNa5eT01IuZa0jNWCd5ty
TLSH
T1EF15CF05EFE404FBE0A3A17C99527702E7F678490361DE8F83A446561F2FEA09E39719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_2038dc6c87295e3338337a95837eb033_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Modifies registry class
PID:3956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact