57db6b272087fa1c98e39e078f2d83cc1daf1aed6b742a2778c9f0e31cabf770

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:15

Target
2026-08-10_94cefa4e3a55d1fb1baa77807acb07ff_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 140KB
Sample260810-tp87pshc64
SHA256 57db6b272087fa1c98e39e078f2d83cc1daf1aed6b742a2778c9f0e31cabf770
MD5 94cefa4e3a55d1fb1baa77807acb07ff
SHA1 9cf1ebe5d6797f7bf58e11634788da772612fb7c
SHA512 c13c01bbb8d2c8741a88f3257e3019b1f4cbb205caccacccdb489ce05a5ffd1d51d13d6e27fcbbfccd1ca8a101ee72170838fabd7df74bcf2542b92181a83e6e
SSDEEP 1536:2B7rnjRwTIaGWF9Ru5fdI9yvzsQfGSe8THnSHLAeGeyLKQt3lS1sWddGB9dl149S:2tVFjBvzlnewHoceGeyLxVSP6E8iDa
TLSH
T109E35B27B3A538F9E1B78239C9610646F772787207615BDF03A446762F236D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1820	4628	2026-08-10_94cefa4e3a55d1fb1baa77807acb07ff_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 1820 wrote to memory of 4668	1820	calc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-10_94cefa4e3a55d1fb1baa77807acb07ff_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_94cefa4e3a55d1fb1baa77807acb07ff_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4668

memory/4628-0-0x00000226B9570000-0x00000226B9571000-memory.dmp

Download