Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
- Size 1.1MB
- Sample260922-k2zz5acd64
- SHA256 a48df84109c93fecbd545454e20131a5f2e455a1c9b6289ce4e4bdc649f5e4e2
- MD5 f3cbee27edab06087b0db88363cf4071
- SHA1 2b8a8b8395548ec53422c6a2b20e73d085798999
- SHA512 c6fc8c43f9b336ae5e49a3828ef07f5d345b05a858a1a7ed63f05767c0b33e2065f7394d1f07b7c1cd1710889179aa503a713e11ba669d1c74d0ed4151e55a59
- SSDEEP 12288:o4tab1DHGEE6TEIUR22Sun6W5sjDc98EIDnj2m4IZYjyiy/rxRAKmr2gDH5DnNdK:94YpS0bsQidjUOjrg75DnZJdb9OF
- TLSH T1C5459F1FFE8620EDC24AC9B49747C9A7992135860734A9FB4EE402712A776E06F3DF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\URL Protocol 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\shell 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\shell\open 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\shell\open\command 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\"" 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\vrhnqje\ = "URL:vrhnqje Protocol" 2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_f3cbee27edab06087b0db88363cf4071_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"1⤵
- Modifies registry class
PID:5596