e2ef07531513c6fd6eccc894f396739d8943624d1bb562191d2917d521d361ae

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 195KB
Sample260808-cv98hsfr7x
SHA256 e2ef07531513c6fd6eccc894f396739d8943624d1bb562191d2917d521d361ae
MD5 f1a0d3a83b167732211fe52e8fee362c
SHA1 f84d59080115c02ebbe51362070f40e9d1d18206
SHA512 3f6110adf5ebe03000715dd6d0eb0ebaa5a08d011c5b966a8f84f15b6878f5eacfcce7b9e032311ad49251ebc4168789cf59cee0a03b8d143b584222181262c0
SSDEEP 3072:YTEfxQni2tcuyyrGCOd2Ly7uS1nhYtPrdsCNGf/21t/lK:K9d5lXuOzdsCNkkt
TLSH
T1A4145A5AB7A200F9E4B7D238C9525616F673781503209BEB43A04B769F237E0BD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3252	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1484	schtasks.exe
5052	schtasks.exe
2140	schtasks.exe
6064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 3252	3316	2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 3252 wrote to memory of 1484	3252	svchost.exe	91
PID 3252 wrote to memory of 3380	3252	svchost.exe	93
PID 3252 wrote to memory of 5052	3252	svchost.exe	94
PID 3252 wrote to memory of 5932	3252	svchost.exe	96
PID 3252 wrote to memory of 2140	3252	svchost.exe	97
PID 3252 wrote to memory of 3292	3252	svchost.exe	99
PID 3252 wrote to memory of 6064	3252	svchost.exe	100
PID 3252 wrote to memory of 2104	3252	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\ProgramData\Microsoft\Windows\svchost.exe
  "C:\ProgramData\Microsoft\Windows\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "RemoteAdminService" /tr "\"C:\Windows\System32\svchost.exe\"" /sc onlogon /rl highest /f /np 2>NUL
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe" --watchdog
    3⤵
    PID:3380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "RemoteAdminService" /tr "\"C:\Windows\System32\svchost.exe\"" /sc onlogon /rl highest /f /np 2>NUL
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5052
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe" --watchdog
    3⤵
    PID:5932
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "RemoteAdminService" /tr "\"C:\Windows\System32\svchost.exe\"" /sc onlogon /rl highest /f /np 2>NUL
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe" --watchdog
    3⤵
    PID:3292
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "RemoteAdminService" /tr "\"C:\Windows\System32\svchost.exe\"" /sc onlogon /rl highest /f /np 2>NUL
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe" --watchdog
    3⤵
    PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\ProgramData\Microsoft\Windows\svchost.exe
Size 195KB
SHA256 e2ef07531513c6fd6eccc894f396739d8943624d1bb562191d2917d521d361ae
MD5 f1a0d3a83b167732211fe52e8fee362c
SHA1 f84d59080115c02ebbe51362070f40e9d1d18206
SHA512 3f6110adf5ebe03000715dd6d0eb0ebaa5a08d011c5b966a8f84f15b6878f5eacfcce7b9e032311ad49251ebc4168789cf59cee0a03b8d143b584222181262c0
SSDEEP 3072:YTEfxQni2tcuyyrGCOd2Ly7uS1nhYtPrdsCNGf/21t/lK:K9d5lXuOzdsCNkkt
TLSH
T1A4145A5AB7A200F9E4B7D238C9525616F673781503209BEB43A04B769F237E0BD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSvcHelper_health

Path C:\Users\Admin\AppData\Local\Temp\WinSvcHelper_health
Size 4B
SHA256 9578b0e4a27925b100bc300d2ffba290491236782026b4aaaac51db0465151ae
MD5 1e3b21cb226c39b6aa4634f820b372f3
SHA1 12ffd9e2935312f410e84382ca91c6d0946f885f
SHA512 a6218b236fa8876ad1947a82fad955f15a4a1f21e2a985d27bf82ea10e7975745e040c4c5fc0389837982f6c12af7eba40b035d2eff9c5385f5fc3398cd50f2e
MD5 SHA1 SHA512

Submit Download

emissor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\emissor_debug.log
Size 158B
SHA256 adbe3d1f1fed0081b736997c5df61d270a0921df7d68b5ec06c9c7c0f5bf2b00
MD5 250bb32c73904bb6529e8a2d0bf1e302
SHA1 91a83544952ee156cfdf2cc94bdeb857894d7d2e
SHA512 ecc4485e1b04866e49576eb9b7f2e852548ffe4f094eafc200661dd40de5d150917eb84731cde16de2e6afd11f09aaad234b85d89c8be0da94c64e9075302aee
TLSH
T170C08C0F04703D70D7201824008B10C98A8E9F30FE88589139CBD9CA9C8E0718233132
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads