c3cfaf71ce9e6ab924dc7d6235b82afdf45e7ef6fdf3ad32b11df89f59ef9dcd

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 443KB
Sample260802-d1tndssvey
SHA256 c3cfaf71ce9e6ab924dc7d6235b82afdf45e7ef6fdf3ad32b11df89f59ef9dcd
MD5 215f1a7e8e6e4005fad4282181bb1a9f
SHA1 33d04b4f246871d44bf7704d45e62ebc7f0756a3
SHA512 8a9c3266fc495bb00db9f6b9036ba91630a2de55b48daace7b8ff6a234d49856eeaa70fe3c481d3fd52a05244f1235249838db96c27dd3fda44dc992bde69fd7
SSDEEP 6144:qpyzcQ+ekihucIpeEQm6/dS2E4ZB5vnuKpNUsJsteh8+ehTnt2xy7jc:ue3/GePnlks6l+ehTnt2xyk
TLSH
T11BA45C19A69805F9E167C178CA978C06E776780A0770DFEF0394DA725F276E08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000006910-0.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Deletes itself 1 IoCs

pid	Process
4624	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5392	d3d9.48094.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
444	icacls.exe
5300	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
1	discord.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4624	powershell.exe
412	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
412	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d3d9.48094.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d3d9.48094.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 5392	5960	2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 5960 wrote to memory of 4624	5960	2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4624 wrote to memory of 5012	4624	powershell.exe	92
PID 5392 wrote to memory of 444	5392	d3d9.48094.exe	93
PID 5392 wrote to memory of 5300	5392	d3d9.48094.exe	95
PID 5392 wrote to memory of 412	5392	d3d9.48094.exe	97
PID 412 wrote to memory of 4908	412	powershell.exe	99

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5012	attrib.exe
4908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\d3d9.48094.exe
  "C:\Users\Admin\AppData\Local\Temp\\d3d9.48094.exe" --go "C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:444
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:5300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$p=Get-Process -Id 5392;$p.PriorityClass='Idle';$f='C:\Users\Admin\AppData\Local\Temp\d3d9.48094.exe';$o='C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe';do { Start-Sleep 0.3 } while(Get-Process -Id 5392 -ErrorAction SilentlyContinue);attrib +h +s $f;Remove-Item $f -Force;if(Test-Path $o){ attrib +h +s $o; Remove-Item $o -Force }"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Temp\d3d9.48094.exe
      4⤵
      Views/modifies file attributes
      PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$f='C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe';Start-Sleep 1;attrib +h +s $f;Remove-Item $f -Force"
  2⤵
  - Deletes itself
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-02_215f1a7e8e6e4005fad4282181bb1a9f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
    3⤵
    - Views/modifies file attributes
    PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

d3d9.48094.exe

Path C:\Users\Admin\AppData\Local\Temp\d3d9.48094.exe
Size 443KB
SHA256 c3cfaf71ce9e6ab924dc7d6235b82afdf45e7ef6fdf3ad32b11df89f59ef9dcd
MD5 215f1a7e8e6e4005fad4282181bb1a9f
SHA1 33d04b4f246871d44bf7704d45e62ebc7f0756a3
SHA512 8a9c3266fc495bb00db9f6b9036ba91630a2de55b48daace7b8ff6a234d49856eeaa70fe3c481d3fd52a05244f1235249838db96c27dd3fda44dc992bde69fd7
SSDEEP 6144:qpyzcQ+ekihucIpeEQm6/dS2E4ZB5vnuKpNUsJsteh8+ehTnt2xy7jc:ue3/GePnlks6l+ehTnt2xyk
TLSH
T11BA45C19A69805F9E167C178CA978C06E776780A0770DFEF0394DA725F276E08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-1-0x00007FF989F3F000-0x00007FF989F40000-memory.dmp

Download

memory/4624-4-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-5-0x0000011679BD0000-0x0000011679BF2000-memory.dmp

Download

memory/4624-6-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-7-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-8-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-9-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-10-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-11-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download

memory/4624-13-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp

Download