4da50dd5d45e964c499552cfb91f44261549d0c03ee08eeffc670e355c7ca0c7

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe
Size 1.9MB
Sample260805-hhpc6sbr2x
SHA256 4da50dd5d45e964c499552cfb91f44261549d0c03ee08eeffc670e355c7ca0c7
MD5 e0542e1a29c04b76342b23203f24c5bd
SHA1 ff0e8036a5b9960ae026fa132864e33198ee4415
SHA512 bad8d9cb3236b367ac725e84d8e6e8763fa5447e08a44afeca200c2390a4b740753d991b7c641c305dc6538b30c250a9f97949e6d7475df055ebe8a0dc13a04a
SSDEEP 49152:jfM945/MDWCZJsrb/T3vO90d7HjmAFd4A64nsfJ6vTdD1hCTxn5guuVn3A3Pjv:gkMJE33Kjv
TLSH
T170951747BE8041E5C4AA92318976D3A17730FC980F2163C33A94BFBA2EB6BD45E75354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4624	2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5016	4624	2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e0542e1a29c04b76342b23203f24c5bd_cobalt-strike_luca-stealer.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\System32\win32calc.exe
  "C:\Windows\System32\win32calc.exe"
  2⤵
  PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-0-0x00000191A18A0000-0x00000191A18AB000-memory.dmp

Download

memory/4624-7-0x00007FF6BED90000-0x00007FF6BEFCC000-memory.dmp