Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 03:40
General
- Target 2026-08-08_47681170e25901bfa954e5445dfead49_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 282KB
- Sample260808-d8cpvazbkf
- SHA256 d67ed2ae8658ae8e2f78b447093d69e988adf077f010c2390693ad70d8b2a575
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies Windows Defender notification settings 3 TTPs 6 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Windows security modification 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_47681170e25901bfa954e5445dfead49_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_47681170e25901bfa954e5445dfead49_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_47681170e25901bfa954e5445dfead49_cobalt-strike_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_47681170e25901bfa954e5445dfead49_cobalt-strike_icedid_luca-stealer_njrat.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Replay Monitor
Loading Replay Monitor...
Downloads
memory/2796-1-0x000002098D170000-0x000002098D172000-memory.dmp
memory/2796-2-0x000002098D170000-0x000002098D172000-memory.dmp