228d9e2017d304a07d8fe84da38239969a4516998a4949e8b9f2b68cf632e505

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 06:54

Target
2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 376KB
Sample260813-hppbracq7s
SHA256 228d9e2017d304a07d8fe84da38239969a4516998a4949e8b9f2b68cf632e505
MD5 233ece0b3ede32e737f5b8abccbdf450
SHA1 4a6dd9866c910a6ab785ee1f2b301510662cb5fc
SHA512 9ee54aded6aee71869fb265296611f7b4e5997a2bb96068e720a281ed3fd27eca38a4ff3ac67b32e954847fad088c768470ee18472af17582573c4ad75fae8ab
SSDEEP 6144:QGQuasPKCGE0DkuSOIwMd7wvcERJoPLg9xMvic86El:QGQFuKIOIwM+zO0vzmEl
TLSH
T1A0848D02FBAD3DEDE06E8134897551A39B31FC351790D6CF16A07B661E32293BD29B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 4648 wrote to memory of 4488	4648	2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_233ece0b3ede32e737f5b8abccbdf450_cobalt-strike_icedid_luca-stealer_njrat.exe"
  2⤵
  PID:4488

memory/4488-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4488-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4648-0-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/4648-3-0x0000000140000000-0x00000001400AE000-memory.dmp

Download