c72ae48240afa38126548f2f889fcdd13ad8f56bbf8c12311e72b02e0941ade8

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 1.1MB
Sample260807-khceqaam8y
SHA256 c72ae48240afa38126548f2f889fcdd13ad8f56bbf8c12311e72b02e0941ade8
MD5 11cc6e4234c8cae8927a6356f2194138
SHA1 44f0864d8178878747d698ee6cc43b0b5b780231
SHA512 e31ddc5e355230f24e4b5dd2d0f592ecde0cf21f9f44cd8dee04b52ed91972e2dee9b4ce6f9f03690a37e9f42e3255fce53f3228e758540d3617463c0520d9ba
SSDEEP 12288:KwdrD7oYs6G9W9oGJDPlgTjoL2tTAYHSh5CT9yom94ASf76iFu9G0eYz1OxMMh/H:nUbXHSh5CTQ94Bf1coTGMhUx1E
TLSH
T173359E0FFE8265EDC24ED8B89747CA93992135CA0725A9FB4EE401722A756E05F3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\""	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\ = "URL:aeobnjbvtl Protocol"	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\URL Protocol	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\shell	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\shell\open	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\aeobnjbvtl\shell\open\command	2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_11cc6e4234c8cae8927a6356f2194138_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Modifies registry class
PID:4772

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads