7938fdff03450fca363cdaddd2a9e1b6512c0415df48dd148bf06e74c79e8998

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 548KB
Sample260907-d5f8vsbr6z
SHA256 7938fdff03450fca363cdaddd2a9e1b6512c0415df48dd148bf06e74c79e8998
MD5 4f58ff3247474323b0ae33d8c6f55371
SHA1 612ec7a530b1375049ec2e032064f9f5c4ca4073
SHA512 1996d5eb8bca7bb38b7c8b37dd833cc1383485548e1960e48b8424ec642eeaf7103a8b5596ad3d71d2b5da8c88cb4dccaa31072d92f3c9f204bdcb35a8f55c94
SSDEEP 12288:RmiMZvN43+u85Bpw+YMRkc9kMh8lbC4vH3SDRxAm:UnvS+55BpfRX9kMytjXSDh
TLSH
T146C48E19F7E404F9E0B7E578CD934B02E776F84907B1E68F03A499A61F232909D39792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5460	mspaint.exe
5460	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5460	mspaint.exe
5460	mspaint.exe
5460	mspaint.exe
5460	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 5460	1132	2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_4f58ff3247474323b0ae33d8c6f55371_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\35.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\35.jpg
Size 8KB
SHA256 b14d9f0b21c4081e3b10e1087cfbbb9ac5ceef28778f0385c0bf42515870722f
MD5 bd77497c637125479ddf9c7deb633f73
SHA1 9bc619768e211fc5aaf4c2b5afe494937944ef41
SHA512 15c9b8edc431266f807fd8010ebea931af9ca1972406e609f8cba95fb2fb7e4f388722190bb7226aa3d09f08e7e4b438558fd3ce8192f7525d796c61ead13285
SSDEEP 192:UhdrRq2q67/MlIpkluXDc5hj8SIppKg7MytaW63nR4MRZC:UhdNq2q6zgPqmhj8SIppR7MfB4MW
TLSH
T12E028D34AB28EE23CE691DBD790D6C52F19F29F0F5C30DE9B10857691A341928F8A05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download