044be4a8318fbae0f612a04efd805c6bdee575c5517289733adaecfa030cbc2c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 598KB
Sample260826-kcb7rssshv
SHA256 044be4a8318fbae0f612a04efd805c6bdee575c5517289733adaecfa030cbc2c
MD5 cf89441b053b6cf27082276f8a562281
SHA1 22826d7b792d24f4a5cd2942eb8831d3884ed0e9
SHA512 4b4095584de00dbb5980a3d4db954a8bd9993d8391e748daece6f93568510207c06b50349f7b3a679b66bf01dc44f010bfa27725632e1ad0cff16a6f39bd640d
SSDEEP 6144:kQqDalKHta6ALKZHcfxOYyZJBFrUjOpzPoVD1DGHm5bXHBHYcckO+kko/:kQq+lKHtLAqOb8zFojZDF5ZXGCo/
TLSH
T14FD4081AEAA541F1C0BBD439CA42652BFC727856833067E757819F532F667D0AB3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Identifier	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4220	2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_cf89441b053b6cf27082276f8a562281_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Looks for VMWare Tools registry key
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads