750eb94125345bb69cd70855789bbcbfb1c9ec1206837e53eb874cd9161737fa

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:53

Target
2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 291KB
Sample260815-wgk61seq2y
SHA256 750eb94125345bb69cd70855789bbcbfb1c9ec1206837e53eb874cd9161737fa
MD5 962741320175841072df0ab6f527c2e8
SHA1 20ec6ad5766796210f322667c67a7a20ad44ea78
SHA512 ec7c08069654a7663b86f4c8da2271da02ab6f52b2fc4e5b1a42585bb45a495d884daf77641c4a9efa77b03f5242d563ee77d57664a25d8e9aa3c6461e34f1c7
SSDEEP 6144:pYVe25AU2D6gVRdlWRJoPLg9xMvic86El:6VB5AIdO0vzmEl
TLSH
T15354AE07FFA620E9E0BF813988A1155BE771782A07A0DADF169442775F336D09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4536 set thread context of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4536 wrote to memory of 4144	4536	2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_962741320175841072df0ab6f527c2e8_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:4144

memory/4144-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4144-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4536-0-0x0000000140000000-0x000000014007D000-memory.dmp

Download

memory/4536-4-0x0000000140000000-0x000000014007D000-memory.dmp

Download