8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 397KB
Sample260810-ca6dtsyfmd
SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
MD5 d30a3ee3eafd3f37015366868c09e725
SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
TLSH
T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2888	sc.exe
404	sc.exe
2176	sc.exe
2952	sc.exe
2880	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe
2620	cmd.exe
548	cmd.exe
4712	cmd.exe
4396	cmd.exe
4892	cmd.exe
3316	cmd.exe
4636	cmd.exe
2568	cmd.exe
2944	cmd.exe
5004	cmd.exe
704	cmd.exe
2996	cmd.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4208	taskkill.exe
2344	taskkill.exe
3332	taskkill.exe
4628	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe
Token: SeIncreaseQuotaPrivilege	2984	svchost.exe
Token: SeSecurityPrivilege	2984	svchost.exe
Token: SeTakeOwnershipPrivilege	2984	svchost.exe
Token: SeLoadDriverPrivilege	2984	svchost.exe
Token: SeSystemtimePrivilege	2984	svchost.exe
Token: SeBackupPrivilege	2984	svchost.exe
Token: SeRestorePrivilege	2984	svchost.exe
Token: SeShutdownPrivilege	2984	svchost.exe
Token: SeSystemEnvironmentPrivilege	2984	svchost.exe
Token: SeUndockPrivilege	2984	svchost.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe
Token: SeIncreaseQuotaPrivilege	2984	svchost.exe
Token: SeSecurityPrivilege	2984	svchost.exe
Token: SeTakeOwnershipPrivilege	2984	svchost.exe
Token: SeLoadDriverPrivilege	2984	svchost.exe
Token: SeSystemtimePrivilege	2984	svchost.exe
Token: SeBackupPrivilege	2984	svchost.exe
Token: SeRestorePrivilege	2984	svchost.exe
Token: SeShutdownPrivilege	2984	svchost.exe
Token: SeSystemEnvironmentPrivilege	2984	svchost.exe
Token: SeUndockPrivilege	2984	svchost.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe
Token: SeIncreaseQuotaPrivilege	2984	svchost.exe
Token: SeSecurityPrivilege	2984	svchost.exe
Token: SeTakeOwnershipPrivilege	2984	svchost.exe
Token: SeLoadDriverPrivilege	2984	svchost.exe
Token: SeSystemtimePrivilege	2984	svchost.exe
Token: SeBackupPrivilege	2984	svchost.exe
Token: SeRestorePrivilege	2984	svchost.exe
Token: SeShutdownPrivilege	2984	svchost.exe
Token: SeSystemEnvironmentPrivilege	2984	svchost.exe
Token: SeUndockPrivilege	2984	svchost.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe
Token: SeIncreaseQuotaPrivilege	2984	svchost.exe
Token: SeSecurityPrivilege	2984	svchost.exe
Token: SeTakeOwnershipPrivilege	2984	svchost.exe
Token: SeLoadDriverPrivilege	2984	svchost.exe
Token: SeSystemtimePrivilege	2984	svchost.exe
Token: SeBackupPrivilege	2984	svchost.exe
Token: SeRestorePrivilege	2984	svchost.exe
Token: SeShutdownPrivilege	2984	svchost.exe
Token: SeSystemEnvironmentPrivilege	2984	svchost.exe
Token: SeUndockPrivilege	2984	svchost.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe
Token: SeIncreaseQuotaPrivilege	2984	svchost.exe
Token: SeSecurityPrivilege	2984	svchost.exe
Token: SeTakeOwnershipPrivilege	2984	svchost.exe
Token: SeLoadDriverPrivilege	2984	svchost.exe
Token: SeSystemtimePrivilege	2984	svchost.exe
Token: SeBackupPrivilege	2984	svchost.exe
Token: SeRestorePrivilege	2984	svchost.exe
Token: SeShutdownPrivilege	2984	svchost.exe
Token: SeSystemEnvironmentPrivilege	2984	svchost.exe
Token: SeUndockPrivilege	2984	svchost.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2984	svchost.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2568	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	85
PID 2568 wrote to memory of 4208	2568	cmd.exe	86
PID 4528 wrote to memory of 2620	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	88
PID 2620 wrote to memory of 2888	2620	cmd.exe	89
PID 4528 wrote to memory of 2944	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 2944 wrote to memory of 3468	2944	cmd.exe	91
PID 3468 wrote to memory of 2052	3468	net.exe	92
PID 4528 wrote to memory of 5004	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	93
PID 5004 wrote to memory of 2344	5004	cmd.exe	94
PID 4528 wrote to memory of 704	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	95
PID 4528 wrote to memory of 548	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	96
PID 548 wrote to memory of 3212	548	cmd.exe	97
PID 4528 wrote to memory of 2996	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	98
PID 2996 wrote to memory of 404	2996	cmd.exe	99
PID 4528 wrote to memory of 3692	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	100
PID 3692 wrote to memory of 2176	3692	cmd.exe	101
PID 4528 wrote to memory of 4712	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	103
PID 4712 wrote to memory of 2952	4712	cmd.exe	104
PID 4528 wrote to memory of 4396	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	105
PID 4396 wrote to memory of 3332	4396	cmd.exe	106
PID 4528 wrote to memory of 4892	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	111
PID 4892 wrote to memory of 2880	4892	cmd.exe	112
PID 4528 wrote to memory of 3316	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	113
PID 3316 wrote to memory of 4628	3316	cmd.exe	114
PID 4528 wrote to memory of 4636	4528	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	116
PID 4636 wrote to memory of 212	4636	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\sc.exe
    sc config winmgmt start=disabled
    3⤵
    - Launches sc.exe
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\net.exe
    net stop winmgmt /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop winmgmt /y
      4⤵
      PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem
  2⤵
  - Executes a command shell one-liner
  PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\System32\Wbem\WmiPrvSE.exe
    wmiprvse /regserver
    3⤵
    - Modifies registry class
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\sc.exe
    sc config winmgmt start= auto
    3⤵
    - Launches sc.exe
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\sc.exe
    sc stop winmgmt
    3⤵
    - Launches sc.exe
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get cat
    3⤵
    PID:212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2984