Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 11:14
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
1 signatures
150 seconds
General
- Target 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 544KB
- Sample260809-ncd8xadr9y
- SHA256 1e1a708182aa3237ac0bc23b40e4174f74354233102100ba5e05052aa3b50487
- MD5 0fa257ce2875e550233f9b53ffa6768a
- SHA1 ea4e8480d74f40460b7c55fd007d573cdf8f33d6
- SHA512 370383e8e17bd3fd4cf2426afb3a489dde54c9e568a4d36cb9566adcd2fde346a8b5b095c11233cbe306b60b16a1f4c4c72b0430d966e010466b6f8d52318210
- SSDEEP 12288:VFauDBbARwSnKq+Dil981Hk0wgHOk0LX6:DNbA3P+tpWLX
- TLSH T16FC45C56A76802FDD167D2B8CA564803F7B1B84A03616DEB03908AB72F175D46F3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0fa257ce2875e550233f9b53ffa6768a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks SCSI registry key(s)
PID:1076