8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 397KB
Sample260810-ca6dtsyfmd
SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
MD5 d30a3ee3eafd3f37015366868c09e725
SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
TLSH
T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4320	sc.exe
2908	sc.exe
2056	sc.exe
4484	sc.exe
2124	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
4316	cmd.exe
4004	cmd.exe
6124	cmd.exe
1624	cmd.exe
5688	cmd.exe
5844	cmd.exe
3988	cmd.exe
2872	cmd.exe
5572	cmd.exe
3784	cmd.exe
1772	cmd.exe
4364	cmd.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2776	taskkill.exe
2784	taskkill.exe
3892	taskkill.exe
2216	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	WmiPrvSE.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4516	WMIC.exe
4516	WMIC.exe
4516	WMIC.exe
4516	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	svchost.exe
Token: SeSecurityPrivilege	3552	svchost.exe
Token: SeTakeOwnershipPrivilege	3552	svchost.exe
Token: SeLoadDriverPrivilege	3552	svchost.exe
Token: SeSystemtimePrivilege	3552	svchost.exe
Token: SeBackupPrivilege	3552	svchost.exe
Token: SeRestorePrivilege	3552	svchost.exe
Token: SeShutdownPrivilege	3552	svchost.exe
Token: SeSystemEnvironmentPrivilege	3552	svchost.exe
Token: SeUndockPrivilege	3552	svchost.exe
Token: SeManageVolumePrivilege	3552	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	svchost.exe
Token: SeSecurityPrivilege	3552	svchost.exe
Token: SeTakeOwnershipPrivilege	3552	svchost.exe
Token: SeLoadDriverPrivilege	3552	svchost.exe
Token: SeSystemtimePrivilege	3552	svchost.exe
Token: SeBackupPrivilege	3552	svchost.exe
Token: SeRestorePrivilege	3552	svchost.exe
Token: SeShutdownPrivilege	3552	svchost.exe
Token: SeSystemEnvironmentPrivilege	3552	svchost.exe
Token: SeUndockPrivilege	3552	svchost.exe
Token: SeManageVolumePrivilege	3552	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	svchost.exe
Token: SeSecurityPrivilege	3552	svchost.exe
Token: SeTakeOwnershipPrivilege	3552	svchost.exe
Token: SeLoadDriverPrivilege	3552	svchost.exe
Token: SeSystemtimePrivilege	3552	svchost.exe
Token: SeBackupPrivilege	3552	svchost.exe
Token: SeRestorePrivilege	3552	svchost.exe
Token: SeShutdownPrivilege	3552	svchost.exe
Token: SeSystemEnvironmentPrivilege	3552	svchost.exe
Token: SeUndockPrivilege	3552	svchost.exe
Token: SeManageVolumePrivilege	3552	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	svchost.exe
Token: SeSecurityPrivilege	3552	svchost.exe
Token: SeTakeOwnershipPrivilege	3552	svchost.exe
Token: SeLoadDriverPrivilege	3552	svchost.exe
Token: SeSystemtimePrivilege	3552	svchost.exe
Token: SeBackupPrivilege	3552	svchost.exe
Token: SeRestorePrivilege	3552	svchost.exe
Token: SeShutdownPrivilege	3552	svchost.exe
Token: SeSystemEnvironmentPrivilege	3552	svchost.exe
Token: SeUndockPrivilege	3552	svchost.exe
Token: SeManageVolumePrivilege	3552	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	svchost.exe
Token: SeSecurityPrivilege	3552	svchost.exe
Token: SeTakeOwnershipPrivilege	3552	svchost.exe
Token: SeLoadDriverPrivilege	3552	svchost.exe
Token: SeSystemtimePrivilege	3552	svchost.exe
Token: SeBackupPrivilege	3552	svchost.exe
Token: SeRestorePrivilege	3552	svchost.exe
Token: SeShutdownPrivilege	3552	svchost.exe
Token: SeSystemEnvironmentPrivilege	3552	svchost.exe
Token: SeUndockPrivilege	3552	svchost.exe
Token: SeManageVolumePrivilege	3552	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3552	svchost.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 2872	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	88
PID 2872 wrote to memory of 2776	2872	cmd.exe	89
PID 1324 wrote to memory of 4752	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	92
PID 4752 wrote to memory of 4320	4752	cmd.exe	93
PID 1324 wrote to memory of 4316	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	94
PID 4316 wrote to memory of 3832	4316	cmd.exe	95
PID 3832 wrote to memory of 3348	3832	net.exe	96
PID 1324 wrote to memory of 4004	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	97
PID 4004 wrote to memory of 2784	4004	cmd.exe	98
PID 1324 wrote to memory of 5572	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	99
PID 1324 wrote to memory of 6124	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	100
PID 6124 wrote to memory of 5628	6124	cmd.exe	101
PID 1324 wrote to memory of 3784	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	102
PID 3784 wrote to memory of 2908	3784	cmd.exe	103
PID 1324 wrote to memory of 1624	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	104
PID 1624 wrote to memory of 2056	1624	cmd.exe	105
PID 1324 wrote to memory of 5688	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	107
PID 5688 wrote to memory of 4484	5688	cmd.exe	108
PID 1324 wrote to memory of 5844	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	109
PID 5844 wrote to memory of 3892	5844	cmd.exe	110
PID 1324 wrote to memory of 1772	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	113
PID 1772 wrote to memory of 2124	1772	cmd.exe	114
PID 1324 wrote to memory of 3988	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	115
PID 3988 wrote to memory of 2216	3988	cmd.exe	116
PID 1324 wrote to memory of 4364	1324	2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	118
PID 4364 wrote to memory of 4516	4364	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d30a3ee3eafd3f37015366868c09e725_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\sc.exe
    sc config winmgmt start=disabled
    3⤵
    - Launches sc.exe
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\net.exe
    net stop winmgmt /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop winmgmt /y
      4⤵
      PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem
  2⤵
  - Executes a command shell one-liner
  PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\System32\Wbem\WmiPrvSE.exe
    wmiprvse /regserver
    3⤵
    - Modifies registry class
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\sc.exe
    sc config winmgmt start= auto
    3⤵
    - Launches sc.exe
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\sc.exe
    sc stop winmgmt
    3⤵
    - Launches sc.exe
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\sc.exe
    sc start winmgmt
    3⤵
    - Launches sc.exe
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\taskkill.exe
    taskkill /im wmi* /f /t
    3⤵
    - Kills process with taskkill
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get cat
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3552