f3590cbd5a986e50987a9607bf0faf9685cb6e88584d645a07bb889f9f785ed1

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_f1240e061001715acb8d0001ea2f5186_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 2.8MB
Sample261001-1py53azy2q
SHA256 f3590cbd5a986e50987a9607bf0faf9685cb6e88584d645a07bb889f9f785ed1
MD5 f1240e061001715acb8d0001ea2f5186
SHA1 29528303254c56bcfbd22e09e4917471c30e0fe4
SHA512 25e9251f005a6e7ddc0aada51282c7aa56d6ea0dc09085e630ccd3e05185d8baedcb9fa119d2d45355700277ed4ba8c1b47fc9aef9d21c5e7b6c69b039dd9cc7
SSDEEP 24576:2bfbqO4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHaxO9cRIAt:2gHFVdDZDfivg+6h+SHalt
TLSH
T1BAD5F70273F807D9F1F34B7849766A5199B6BCA9EE10C39E15A1710E0D32B948C76B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5376	UniKeyNT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5376	UniKeyNT.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5376	UniKeyNT.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5376	UniKeyNT.exe
5376	UniKeyNT.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 5376	3120	2026-10-01_f1240e061001715acb8d0001ea2f5186_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe	88
PID 3120 wrote to memory of 1660	3120	2026-10-01_f1240e061001715acb8d0001ea2f5186_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-01_f1240e061001715acb8d0001ea2f5186_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_f1240e061001715acb8d0001ea2f5186_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\UniKeyNT.exe
  "C:\Users\Admin\AppData\Local\Temp\UniKeyNT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UniKeyNT.exe

Path C:\Users\Admin\AppData\Local\Temp\UniKeyNT.exe
Size 2.4MB
SHA256 b732b1c198e7b0ebfcb0ef2f5d99f1888b5900460c1fa36ea27d47e8386684b1
MD5 95633564353da11c2553df08ad4a6a85
SHA1 379a90b9c161c380906be26b210db35aa911216e
SHA512 ae68fa3bdc4e5fbb9506c07ed08925f5efdb6424d9f15c21f48413a5ccc83b7de0dc9acf9cdbaec273331cf586d31dffba936a030e5c3b7a811783166483d3a8
SSDEEP 24576:4bfbqO4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHax2:4gHFVdDZDfivg+6h+SHao
TLSH
T19CC5B50673F807D9F1F34B7849756A5598B6BCA9DA10C39F15A1710E0E32B988C72B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3120-8-0x00007FF79F7F0000-0x00007FF79FAC1000-memory.dmp

Download

memory/3120-10-0x00007FF79F7F0000-0x00007FF79FAC1000-memory.dmp