Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 17:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 698KB
- Sample260908-vxlxtavwft
- SHA256 2f299c49e4dc68e0a54851110d0844e031491043034c4da49603e7809a440293
- MD5 4aa61e02c9b69d62836b872bcedfa1bb
- SHA1 dc5162d2dd6e886dc7c19df502a94708b6775820
- SHA512 27447cab6ea7a87385374141777dae418198ec249427e0bbecd1df5dbb0e6ebc50a33b3252f6677738c57cb02ac2e6d6e99c1dc9daad694ffeb6aaebd3d4c7a1
- SSDEEP 12288:boDluRVfealJZBHReeXmp+6l5gcGXp1IYPSOzaIFJ3hCKd+QgIkyRifF:bwluR19lJZBdCOzaIr3gK0QgI
- TLSH T172E4C0248A7445ABF61640FE2861F3727471B07106305FEB42A8E72A1F135E54BEAFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2228 winsvc.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: winsvc.exe File opened (read-only) \??\U: winsvc.exe File opened (read-only) \??\V: winsvc.exe File opened (read-only) \??\Y: winsvc.exe File opened (read-only) \??\E: winsvc.exe File opened (read-only) \??\G: winsvc.exe File opened (read-only) \??\I: winsvc.exe File opened (read-only) \??\N: winsvc.exe File opened (read-only) \??\R: winsvc.exe File opened (read-only) \??\S: winsvc.exe File opened (read-only) \??\W: winsvc.exe File opened (read-only) \??\X: winsvc.exe File opened (read-only) \??\B: winsvc.exe File opened (read-only) \??\M: winsvc.exe File opened (read-only) \??\O: winsvc.exe File opened (read-only) \??\Q: winsvc.exe File opened (read-only) \??\Z: winsvc.exe File opened (read-only) \??\H: winsvc.exe File opened (read-only) \??\J: winsvc.exe File opened (read-only) \??\K: winsvc.exe File opened (read-only) \??\L: winsvc.exe File opened (read-only) \??\P: winsvc.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\NVIDIA\Worker\old\winsvc.exe 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe File created C:\Program Files\NVIDIA\Worker\old\winsvc.exe 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winsvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winsvc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe 2228 winsvc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2228 winsvc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4520 wrote to memory of 2228 4520 2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_4aa61e02c9b69d62836b872bcedfa1bb_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files\NVIDIA\Worker\old\winsvc.exe"C:\Program Files\NVIDIA\Worker\old\winsvc.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe1⤵PID:1036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\NVIDIA\Worker\old\winsvc.exe
- Size 698KB
- SHA256 2f299c49e4dc68e0a54851110d0844e031491043034c4da49603e7809a440293
- MD5 4aa61e02c9b69d62836b872bcedfa1bb
- SHA1 dc5162d2dd6e886dc7c19df502a94708b6775820
- SHA512 27447cab6ea7a87385374141777dae418198ec249427e0bbecd1df5dbb0e6ebc50a33b3252f6677738c57cb02ac2e6d6e99c1dc9daad694ffeb6aaebd3d4c7a1
- SSDEEP 12288:boDluRVfealJZBHReeXmp+6l5gcGXp1IYPSOzaIFJ3hCKd+QgIkyRifF:bwluR19lJZBdCOzaIr3gK0QgI
- TLSH T172E4C0248A7445ABF61640FE2861F3727471B07106305FEB42A8E72A1F135E54BEAFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\userdata\Sksyn.dat
- Size 107B
- SHA256 10a8d32f20a09580f963cfc3a321aedc37b1e252b349f4cf5242fe9f3d37c609
- MD5 77d6a210aa969d788aafb189a35de015
- SHA1 0507a455ed5b087835a69c7931b187c718ad5c30
- SHA512 a089a9aeb93acb50d96e0ed73b2c03d87f35ab04fd1ddab29852568c36756419b749163a69d76fe909e364563f955e64c1f282d5d7aa00b842be590bb4566ce0
- TLSH T168B01280D503D643353510835B222E00F23C9C1DD35720980AC8CB19732273C54FA885
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\userdata\Sksyn.dat1
- Size 26B
- SHA256 b131d9b0549cccb6ce2ce53a50d860058203b5089b52a56a19bdedf8aae1cdb7
- MD5 f7f06b560eb6634983a818dd611421af
- SHA1 d507677b95a9b51c50b5f5d7b9ff672d1ad37347
- SHA512 3dd441c3ad72913263e7c7d38f2662bcf37cb6cf9bbd095c270dc1554297c01466d9d5851c2fd506cebb5a02a5636978338079eb685cf723b14029972dc01a13
- MD5 SHA1 SHA512