f385c853f7df277e00c7f35205ff45fc859b699fc2bd4ae902564d032385457b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:50

Target
2026-07-29_875af4fa47fcc35876b1365b44d94442_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 222KB
Sample260729-mxlm2ssbkh
SHA256 f385c853f7df277e00c7f35205ff45fc859b699fc2bd4ae902564d032385457b
MD5 875af4fa47fcc35876b1365b44d94442
SHA1 9053d108aba0d090c902e762964c60a30cc2d25b
SHA512 e0359d420d3ce61ef13f912bfb66c7a15e7461d6c8cd68b371330fb72bc52b4032f349d416accd9661471c98f8df043ee07e6caa5e0f179ffa9a8361bfc8f436
SSDEEP 3072:sy9WcAYNQL7T7jL2NOkMFHYZN+2ixd1bmH2wQscTBn1e4byS1SYOr5HL2:PW2NQL7n2gF2czo2wnz4ySsY6
TLSH
T18E249D5576A508FBE4779138CE510A46E672785147209BFF03E047FAAF232D0AD3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1672-0-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp	UPX
behavioral2/memory/1672-4-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1672-0-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp	upx
behavioral2/memory/1672-4-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp	upx

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4472	1672	2026-07-29_875af4fa47fcc35876b1365b44d94442_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4472 wrote to memory of 6132	4472	calc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-29_875af4fa47fcc35876b1365b44d94442_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_875af4fa47fcc35876b1365b44d94442_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6132

memory/1672-0-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp

Download

memory/1672-1-0x0000028528680000-0x0000028528681000-memory.dmp

Download

memory/1672-4-0x00007FF6E5670000-0x00007FF6E56AB000-memory.dmp

Download