714faf3e73912eb178451bbf496fe9ca3ed12b8b5774cd63598f32b7538e36c2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 504KB
Sample260925-phl2dawale
SHA256 714faf3e73912eb178451bbf496fe9ca3ed12b8b5774cd63598f32b7538e36c2
MD5 32e56932f7d07e79da577465a9daa240
SHA1 a2023e65f710f447ec08e0f98f9c82217fd87c1f
SHA512 32f0c5c61b660ac3a830b78b9613027c73a38b91c402fc78982523206a4391b9b35a2d699521e3780ef5aac7829b4cc1302af722928150593ed3e54a54b2b7ea
SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3lY5tkuzd:qmiMZvN43+u85Bpw+YMRkc9BWouR
TLSH
T1EBB46C19D7E405F9E0B3A678CD924912EB777C490771D68F03ACB9A61F336908D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	mspaint.exe
4620	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4620	mspaint.exe
4620	mspaint.exe
4620	mspaint.exe
4620	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4620	4396	2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\s.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\s.jpg
Size 25KB
SHA256 0c0cbd14e8b4ee736d721827066b1f91001ffd22dd14e7ea221cf2a9c1fa6cf3
MD5 75cfd764ce424ade5b02634623a1f044
SHA1 c3997923576281419066b69ee7aa724f2fc28092
SHA512 ea29a27ddd2a36d2c3a7ab5373718132919cf2d7f7e86a0891790056e38782b0a8962bf54b5807afdb69fe5ed2c94f3384f0248e79979fe897d7af4732032e3e
SSDEEP 768:wUyp+bdGhnJUxjURYDxxBfE3UBnicui6R:Up+chKxjUKDxxBIh1
TLSH
T186C2F1588367988CED621631231A259BE12ABF683BC37866F54E0001CD4E6E3FFD395C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download