1d1e940f31743486a6fc36ffb2fd22191ff14b44f524e2093ccc95acf7355542

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:25

Target
2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 417KB
Sample260808-pllj1sdd97
SHA256 1d1e940f31743486a6fc36ffb2fd22191ff14b44f524e2093ccc95acf7355542
MD5 23088870e6e3a620dda8ad9ccaf5e965
SHA1 a34e2aa5249c590c9e4cf1e1bb17d94b351d7e10
SHA512 4788fa59de31b3288ddbc7b529cb4784af9534c0378ded6ff2582084320594ae77503497875d134bf2161ed84bca69ec53a6e0073553d7aa85f46e81a854daea
SSDEEP 6144:uIdwfD8e4JOSDDeduIjc4+MYpGqRnInNWEKki:RareOSmd3OFG3NWE
TLSH
T1F9945B0AB6A524F5E5B7C13DC952150AFB7278A24760DBCF13A04A5B1F237E09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6140 set thread context of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89
PID 6140 wrote to memory of 2936	6140	2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_23088870e6e3a620dda8ad9ccaf5e965_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:2936

memory/2936-0-0x0000000140000000-0x000000014004B000-memory.dmp

Download