463a9f0dfa12d4d0f141812315a2214a4f063259ba31f16043ea0c2490a5d43b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 00:21

Target
2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 273KB
Sample260813-anj2msgp4t
SHA256 463a9f0dfa12d4d0f141812315a2214a4f063259ba31f16043ea0c2490a5d43b
MD5 b148ef5742a45d231b7f2981995518e4
SHA1 75911e98973dad3ed4b0eeee455afa7413e032cb
SHA512 f48512eeaac714c4ce565bfdfb2b4c9981421d43f7699c290cc0ceb5a84f0b67a2d48e94a29035b0e3daa184d6edbf81710b6d8c9b7f57336cae86b64da3a6e6
SSDEEP 3072:C7UOsfXxhrauZnBzNuy5pCkTZcn9PSUq6O2qWyHh6/2buAs0FNmhMn+IhNO/s36t:CofxhWuHtQUZc9Zvo4LYlw
TLSH
T135544A46779A11E4D0768134877347E2AB3D7D215791CA8F13907B66AE3E2C0FD2AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88
PID 3120 wrote to memory of 1956	3120	2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_b148ef5742a45d231b7f2981995518e4_cobalt-strike_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:1956

memory/3120-0-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/3120-1-0x0000000140000000-0x0000000140057000-memory.dmp

Download