d22a653f32c377195b875902c838ff2dfd576f4714d55ce4915569394f127a3d

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:17

Target
2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 235KB
Sample261024-ds7kaafv2s
SHA256 d22a653f32c377195b875902c838ff2dfd576f4714d55ce4915569394f127a3d
MD5 9b8abb35703acb61234f47f33fcab623
SHA1 626a80fe1d24a2d97d32c6536e95cf1cceab76cc
SHA512 714efe8eda0d4531a1e7e4faed8e3e258fcd650cc0cf350207a296fd70ad5a244cddbc44f57a4ac955a3c7d83df8ef4903539654478807007699bf685abe71d4
SSDEEP 3072:J3TW5Vp4VXE5gLWTWPxB8s74Uh0rhchkSeDHvrp1gLWy/xllC2rwK:J3TIVpgE5uWyPxB8c4weSEey
TLSH
T1BB348C4573E50CF9F5B78239CD625606D6723C511760EBDF07A046AAAF23AE04D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
1	discord.com
2	discord.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
5308	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe
2676	2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 5308	2676	2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe	89
PID 5308 wrote to memory of 3440	5308	cmd.exe	91
PID 5308 wrote to memory of 4140	5308	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
PID:2620