c915c76b341a037d95b054c6fe2ca4c007598ee28781b85d100db1ce102ac31c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_2895dfeffc242df1399cfe07230ddf70_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 301KB
Sample260820-xxtc1afd55
SHA256 c915c76b341a037d95b054c6fe2ca4c007598ee28781b85d100db1ce102ac31c
MD5 2895dfeffc242df1399cfe07230ddf70
SHA1 f6fd7215a4f63dc251eb02c7ca2115fce63a5978
SHA512 4646d28ac6811674c768df76e9ece3bba5bc5cbd1888f32b15f64be492f428d47d350ac24bee0a035edd8902ffbfbe54d71900ac6c0391a82c656db41d9a0321
SSDEEP 6144:0drVKLvusElMyBk22H3uunD6/ovT+4gEc5e:0B0qsElMc2X7u/ovTP65e
TLSH
T13064CF56B6A621FDD2678A7DC0410596E7B23C220B9097EF07B047B69F232D05D3AF72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3468	~pt_payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 3468	936	2026-08-20_2895dfeffc242df1399cfe07230ddf70_cobalt-strike_icedid_luca-stealer_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_2895dfeffc242df1399cfe07230ddf70_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2895dfeffc242df1399cfe07230ddf70_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
  "C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe"
  2⤵
  - Executes dropped EXE
  PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 194B
SHA256 027ce5b1b57a9cc170e2213615b68aac4a2793a60033914c698fc48191d26782
MD5 f2dfcea4022851c13e23aae636a6a634
SHA1 8e996621e80f14ead92da7a748e977243a22fb00
SHA512 a352a3a3ec7557f4678be2485de2309f64ecf1788533353608ecd8fbb2caa1bc6d4ad9701ce96c7314675263db3c25d64339cd5f8da0f55ff01ff0509f14f4d4
TLSH
T1ACC022A1028B840D116CE06E11715BD8B07478A83A032A614720A6207C0D80B70FB21E
MD5 SHA1 SHA512 TLSH

Submit Download

~pt_payload.exe

Path C:\Users\Admin\AppData\Local\Temp\~pt_payload.exe
Size 132KB
SHA256 6e63864db694939f65c2bc998c0824cf049a4172e40e3ad01f70a7f8a5906068
MD5 60cbc2dff7d7fad0bad716d8feabb311
SHA1 9ebdf576893fbaf62d611f41eb2fb121205fd5f9
SHA512 aaec0f9847d3e867aaa86c8883a7874f81c2667888b787175de2e2f40a9bef1b5cd9188e6ea0a63ae711c59a0469b6f65fb50e21d9fce99153b62defee1db98d
SSDEEP 3072:fqscEhZJXWG7D6z3DWkWjs5w/jTZ3q9sC:CsXXW2D6zaI5wvZ2
TLSH
T16ED36C5B73B231F8E077827989A14646E772B87207609BEF07E442665F236D18D3AF31
MD5 SHA1 SHA512 SSDEEP TLSH