b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:31

Target
2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 196KB
Sample260804-d3khha1drd
SHA256 b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7
MD5 09e09dd0b952114838f62d3fdbd68409
SHA1 20a50f635f79bcccf94b1d5bce2d9caf9511d9c9
SHA512 ed836cf0d8a715a42f0170342209f462259e8d60d4621a158496279b7240493db16309de1f851c5273ebb6d50b24e20df2d15035012a4d336bfa3fd05daf10a6
SSDEEP 3072:eSqUv31BAAL0d5LqXLlR9ORo72VtTGlskQvdWUyk1UNxo9hK2x8br:eSqUvlBAAkL2LbSVtKl+DDO
TLSH
T156147D15B7A510FAE9678778CA520901EB737C460770AADF07905BB29E336E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 368	2000	2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
  javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\modules.cache V
  2⤵
  PID:368

memory/368-2-0x0000015BD8F00000-0x0000015BD9170000-memory.dmp

Download

memory/368-11-0x0000015BD8EE0000-0x0000015BD8EE1000-memory.dmp

Download

memory/368-12-0x0000015BD8F00000-0x0000015BD9170000-memory.dmp

Download