0f26f4370ce65018b4e138bfc7307871fbe420b34cd4579894e7bc1867d1f5eb

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 992KB
Sample260815-h1prnaee77
SHA256 0f26f4370ce65018b4e138bfc7307871fbe420b34cd4579894e7bc1867d1f5eb
MD5 cb1e21560243fb78dbdda72fe8cac524
SHA1 53a1bd22fc4f57e8461d9e63da1c89f2a97fd21b
SHA512 24fe54178c799949e279ef1e9d3b4614fc550fd86132f5f850b897652be77ab720681c514deab5dd7d000bdbbc7fae88cae83621762764ed341ab68f076ed4ae
SSDEEP 12288:JyHZ61X560+vYdc8/G9GrPE0rQa4gs/61HSqN88RCPKuWL+dbiXstmci08:iZe40+AdTG9SPE0rQa4gs/6NSgmK3jM4
TLSH
T18A258E29A3F802F9D0F6D6389E535443E97278164B30A6DF02A1415A3F7BEE48F79B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_cb1e21560243fb78dbdda72fe8cac524_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks processor information in registry
- Modifies Control Panel
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads