dc2dfd1c81b1b18fcfb1abda84f0ddfb0274ebeeadb265bf55fbd4cf0e8d6b8f

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 517KB
Sample261003-lbkcescd66
SHA256 dc2dfd1c81b1b18fcfb1abda84f0ddfb0274ebeeadb265bf55fbd4cf0e8d6b8f
MD5 7df704f06651b56641b44a50d7fc1a82
SHA1 2b03ec2ad9aabe3d06bf8649d81c78d43a751b58
SHA512 9790d3912da7698f1aac7afaa902755e4f3a494664ab5a78cc60434b8c98a9cf8349988b0f2f8f6fc1a2a2563c3ecdc8f1dc3c73fbf32e13173b6aab12a3cac8
SSDEEP 12288:/RZeGAfqNGA3Uq29XIDixjpyq0BKbtUJY21c2M:/RSfrAEH9XIYpj0BKbtEkL
TLSH
T153B49E19E7E404FDE1B7E578CE934902E77678490771E6CF03A499A61F272908E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	mspaint.exe
4516	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4516	mspaint.exe
4516	mspaint.exe
4516	mspaint.exe
4516	mspaint.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4516	2800	2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dowad.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dowad.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dowad.jpg
Size 54KB
SHA256 d20d6f85587e96727774be5a68a59743ab3cf2dabfc008c5f497bed0917c0e3e
MD5 8ed6e5de9894f5c295037d22d42b76f4
SHA1 050bf0161f0d22f19ec955f770575463b91c1db9
SHA512 58f6cd606396cdcfc05fd0986a7d424d165b534fb533c6fd81f093e639fd486239d6cda044309f189e66662957b886719f4c9fd3a28da08e82dd0594dbe851fe
SSDEEP 1536:+M9P8sZpV6y6JAhrsvuByMtO/ujai9WlLb:+QPRpIyD99AMNDW1b
TLSH
T16D43F124C0CD4A06A338D03D664EF1BED32BD7954E19AA98F9212EF591E71CB5F1EA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download