b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:31

Target
2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 196KB
Sample260804-d3khha1drd
SHA256 b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7
MD5 09e09dd0b952114838f62d3fdbd68409
SHA1 20a50f635f79bcccf94b1d5bce2d9caf9511d9c9
SHA512 ed836cf0d8a715a42f0170342209f462259e8d60d4621a158496279b7240493db16309de1f851c5273ebb6d50b24e20df2d15035012a4d336bfa3fd05daf10a6
SSDEEP 3072:eSqUv31BAAL0d5LqXLlR9ORo72VtTGlskQvdWUyk1UNxo9hK2x8br:eSqUvlBAAkL2LbSVtKl+DDO
TLSH
T156147D15B7A510FAE9678778CA520901EB737C460770AADF07905BB29E336E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1776	4612	2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
  javaw.exe -cp C:\Users\Admin\AppData\Local\Temp\modules.cache V
  2⤵
  PID:1776

memory/1776-2-0x000001B025310000-0x000001B025580000-memory.dmp

Download

memory/1776-11-0x000001B023A70000-0x000001B023A71000-memory.dmp

Download

memory/1776-12-0x000001B025310000-0x000001B025580000-memory.dmp

Download