Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 624KB
- Sample260919-rb2vcssshw
- SHA256 dff0f44db8e4b1eed7d58557a841c03612aaccf41b77b28dfc67be8d6ca919ce
- MD5 51ca949d215ef015e193532860c0db27
- SHA1 e19e2acae76a77dc4df216d33b850874728a3863
- SHA512 e2096b613becadcf8a9d6454a03225b8fc4515ed3b126c6fbc48cac2521f136bab30b442c195f454aea570201f44ea7a1e9e5273e7198eb61e80665b9f1a8a55
- SSDEEP 12288:A5W+Ec9SeOUbXo3Q58gxom3c2xlBHyMt3IcHKK21sY1SHu4sG:AbSefbcF2F73htO4sG
- TLSH T18DD4AED6DE9364E3D06BDA31907122174B7AE1226B1C97570258C75E2EE3CF4CEEBA40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b87a-2.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b87a-2.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b87a-2.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b87a-2.dat INDICATOR_SUSPICIOUS_EXE_RawPaste_URL - Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rx86B721540F5C.exe - Looks for VMWare services registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci rx86B721540F5C.exe - Executes dropped EXE 2 IoCs
pid Process 5152 rx86B721540F5C.exe 4124 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe\" --watchdog" rx86B721540F5C.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe\" --watchdog" svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe 5152 rx86B721540F5C.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2532 wrote to memory of 5152 2532 2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe 89 PID 5152 wrote to memory of 4816 5152 rx86B721540F5C.exe 90 PID 5152 wrote to memory of 4124 5152 rx86B721540F5C.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\rx86B721540F5C.exe"C:\Users\Admin\AppData\Local\Temp\rx86B721540F5C.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:4816
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" --watchdog3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4124
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rx86B721540F5C.exe
- Size 489KB
- SHA256 5fd91456cb8f14b6226d2c1f74bf9a536792e53c182aa1265b3f37ee743632ab
- MD5 65ad1237b571c177306fa177552e62e3
- SHA1 60bdfdf88d2fd8e2e92de390daf8fbf4bbecb76d
- SHA512 f825d1ac3e7f2ac093465c8c3696365a8669d398b2402c291ee65568924cec92e4b492ae5d8a6f3f0cc0c2aeb56b4d9e08ccafea65cfd1508d7679865962b773
- SSDEEP 12288:nu2tOfvO7wkkUawPa74a2cQ7iJufnFJTQkWk6:nu2tgO7HkQy0X7guJTQkWf
- TLSH T14EB48CE5779817F8E877C03AC8566613FA71745003909AEB87A489396F132E26E3FF11
- MD5 SHA1 SHA512 SSDEEP TLSH