Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 12:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 366KB
- Sample260824-pmjrtaxfld
- SHA256 11f6558bc0bd12697ca40f12790dae20738f1d6c5787de712ec70b0f64dc84de
- MD5 4a98c5d10fc5d088f2ba9490de55b4b3
- SHA1 2fc4d37b0c1fd93e30f88706dc12e00004170ca7
- SHA512 fb4349462eb7a99c7bddc9d8518b5bc775f81564f96fa7d96650aec05894665fa1e161b32cae447f07cfcde1b167c9f142f84620d0f5d78a8508446ddf1aba8f
- SSDEEP 6144:TY9lyOjj26zjB8mnc4BzeTqUxZxFz1zR8NYXKt:mkOmG9B5UxZ1zR8
- TLSH T1B8848E16E7A804F9E1B7D178C9634906D7727C9A07A0A7CF33A44A961F23BE05E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe" 2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe" 2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4528 2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 1824 2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4528
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1824