Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 690KB
- Sample260818-dnj87avejd
- SHA256 03d455dc58761b23256d79f6fec0d8df51c51f2f8435ccf229da115a8d44f25c
- MD5 8b23139410a0af673ce47abe64be8534
- SHA1 15d177d60a462e91ae05e3759f48465d32600c87
- SHA512 d515b5a68acbef71aac7e4cc8aac8e97b10476966a61e1096e6242426b6a46b3e3cd9bf03841f81d16afe90b5c6319622c5d7e80b885814961878f9f684e7860
- SSDEEP 12288:OlQPVB/8DPMv0UNsnC/pKtEi6E7qJ7fz4T0l1p9Ca:eQPw7Mv0UNeCgZQ7f3X/Ca
- TLSH T116E4D0245BB416DBC54781BA19A0A7727430703153715AEF42B4EA382F278F18FBAF76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1456 diagmon.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: diagmon.exe File opened (read-only) \??\W: diagmon.exe File opened (read-only) \??\H: diagmon.exe File opened (read-only) \??\U: diagmon.exe File opened (read-only) \??\V: diagmon.exe File opened (read-only) \??\Z: diagmon.exe File opened (read-only) \??\G: diagmon.exe File opened (read-only) \??\I: diagmon.exe File opened (read-only) \??\J: diagmon.exe File opened (read-only) \??\K: diagmon.exe File opened (read-only) \??\N: diagmon.exe File opened (read-only) \??\O: diagmon.exe File opened (read-only) \??\P: diagmon.exe File opened (read-only) \??\Q: diagmon.exe File opened (read-only) \??\B: diagmon.exe File opened (read-only) \??\L: diagmon.exe File opened (read-only) \??\M: diagmon.exe File opened (read-only) \??\S: diagmon.exe File opened (read-only) \??\T: diagmon.exe File opened (read-only) \??\X: diagmon.exe File opened (read-only) \??\Y: diagmon.exe File opened (read-only) \??\D: diagmon.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Runtime\Handler\v4\diagmon.exe 2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 diagmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString diagmon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe 1456 diagmon.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1456 diagmon.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1456 2020 2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_8b23139410a0af673ce47abe64be8534_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Runtime\Handler\v4\diagmon.exe"C:\Program Files (x86)\Runtime\Handler\v4\diagmon.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe1⤵PID:1704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Runtime\Handler\v4\diagmon.exe
- Size 690KB
- SHA256 03d455dc58761b23256d79f6fec0d8df51c51f2f8435ccf229da115a8d44f25c
- MD5 8b23139410a0af673ce47abe64be8534
- SHA1 15d177d60a462e91ae05e3759f48465d32600c87
- SHA512 d515b5a68acbef71aac7e4cc8aac8e97b10476966a61e1096e6242426b6a46b3e3cd9bf03841f81d16afe90b5c6319622c5d7e80b885814961878f9f684e7860
- SSDEEP 12288:OlQPVB/8DPMv0UNsnC/pKtEi6E7qJ7fz4T0l1p9Ca:eQPw7Mv0UNeCgZQ7f3X/Ca
- TLSH T116E4D0245BB416DBC54781BA19A0A7727430703153715AEF42B4EA382F278F18FBAF76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\userdata\Sksyn.dat
- Size 114B
- SHA256 184fec511fe5aa12503cfcb9d4b7356c93ab1782fcf342ad0aebfed880b64dda
- MD5 142dfcd835a18c67d8da0db344103c74
- SHA1 2e701042c1eda30e8b3a3ba28f0578948061aebb
- SHA512 df575c29c801c8e454eaccd6b564b6f62e80984b313fc48f7daa96cdfd02595ef64cc5fed706cb436c4be4d87b8b5f62aa53a3f6b5c6c0b2f4f8a79c4c96bff8
- TLSH T1AAB0121CF8F2C3EA7513B4032B515E928300475561E740CD23BADF1F4BC962F3419540
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\userdata\Sksyn.dat1
- Size 26B
- SHA256 0f483088aec24659be21441a5ab069951e2ff91f40c37763717e7c0ae8eaea74
- MD5 1282e49538d41303d040c6aff780de9e
- SHA1 336f56b531ab3603c5e6918c7a43582208e702df
- SHA512 0627a492e3872cd44c4129b428cdfd478c54824021a877e4df934239b20c062f19af10138985cb5796597a9607038f9447c4a9724d991744d4b6d4f01f7742cc
- MD5 SHA1 SHA512