ffe12562e921eccf9e94720c34076580c8609109b727d43a9d91826e8c6be2a0

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 354KB
Sample260803-fa1ecsydna
SHA256 ffe12562e921eccf9e94720c34076580c8609109b727d43a9d91826e8c6be2a0
MD5 fa02d10d5e46f39f09f78ca3da65ef83
SHA1 6b182b09f0b9c48142a8ae91f1d46267a346f11e
SHA512 813434ed708449a78d35fb4114002630ba739d337016fdfb3e457a5c259eedecae8e5e810d91240fadd5a9f9256fc0bdd0fffd21f4b3f8a80ecb6031117082d1
SSDEEP 6144:kUfWTz+bAFk3I6kqX5V/cn6l/r4SwKsdy3fB:lW2TNv/c6N0VKkm
TLSH
T1B0748E2AF7A414F9E177D138CD524906EB72BC4A07A097CF27A04A961F276E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	discord.com
1	raw.githubusercontent.com
1	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3744	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3744	cmd.exe
2580	netsh.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3744	2748	2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 3744 wrote to memory of 2580	3744	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2580

C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa02d10d5e46f39f09f78ca3da65ef83_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
1⤵
PID:2948