0571ff5c27b0e10429a1c908a1e2a8de341fc9215c49998a1f52119ab20fe2ba

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_90fb8186acbefa3eae49fd213922c339_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 770KB
Sample260913-psbndsbc37
SHA256 0571ff5c27b0e10429a1c908a1e2a8de341fc9215c49998a1f52119ab20fe2ba
MD5 90fb8186acbefa3eae49fd213922c339
SHA1 7f4f1b21feacbda30d0268145f1dc74d37315e07
SHA512 c7e3dec150704127fdf85d487b413f85f70c3efb333e53395858fd8c1099c82571d4cb55f7c60d65e7d7ca8c61c70b6a5404f0e185e55e0a95d31dec25227da8
SSDEEP 12288:kmiMZvN43+u85Bpw+YMRkc9dEMeIB4ED4p5Y6bQgLp7K:BnvS+55BpfRX9dEMeIeED4p5Y6bN9K
TLSH
T187F4AE0BCAEA48EDC427863889A20401E775F86E4B36D39BC7D4EDD5DE3B2D16935312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	2026-09-13_90fb8186acbefa3eae49fd213922c339_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	mspaint.exe
4944	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4944	mspaint.exe
4944	mspaint.exe
4944	mspaint.exe
4944	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4944	5032	2026-09-13_90fb8186acbefa3eae49fd213922c339_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-13_90fb8186acbefa3eae49fd213922c339_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_90fb8186acbefa3eae49fd213922c339_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gg.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gg.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gg.jpg
Size 19KB
SHA256 fbe650872e50ec75ae838eb9f69fff57b25c171f9e10d713353cd04c97f4f6b3
MD5 023aeb82127f81c2fdbca42dcd3853c5
SHA1 aed543a890b4518908c1636a654c1ad44599feac
SHA512 0e9ed814b730401e26344028f9a6017845dfd5652f70a7cdc5b98410d732acb2361f6143b041dfd9b12ed71aae26483aec274797df93ffe60f5db009a5108c85
SSDEEP 384:6CPoFKBfQyUphHCoJiY/1net+m0vtZs+GxMw4971GD/HrF1:6knrC1CoJiY/JekptSXGwK71c/Lj
TLSH
T12092D1318AE77524DD0BF7318439AA367283D0E2F01E95109B6479C531F8E86286F3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download