Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 486KB
- Sample261029-2nmajscf45
- SHA256 ff801424b2d22913851743e19fd49b64bf575b93bef66df924994046aa2bdb2a
- MD5 9bda2a6e984866376d3435f51342753d
- SHA1 b66f3917d3b21b661f96c73bdd2404f49de240d3
- SHA512 247cd796d2dc2729425e8ac03448a79302b354748cecb027608e7a45b4ccf4ff301b943c59cf5308c39bd21fad514c7fe81219ec156b27d2c27a95a3b5a1d690
- SSDEEP 6144:jiX/l49RLWKJGSE0YLBpqNfUgF0S6OvEG0Ug5zd1Jd1EJKdAh5LimXpv4MH:jQtAJGSXYVpqNBF0j5zdR6JKMiU
- TLSH T1E8B4AF95B2E902FDE1BF90399A56A807F6323405076099DB03E04AF54F27AE15F7F722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe 3904 2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9bda2a6e984866376d3435f51342753d_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\pyviewc_sim\research\_pyviewc_arisco.log
- Size 1KB
- SHA256 8652caf270bfad4c8479accb94b8c5308b036b376314429700addb7a102d6e94
- MD5 6aeec2fca120b8d4e52ae634c156ff40
- SHA1 4d9f5661ac2294883072243cf79b86ec176597b4
- SHA512 a2b63af4a388160a7aa78461fba0798cc6f83c2e380a91fa6e7dc8498ecb5bb4e244f18a79a3ca65ad08dc4f4ee32fcbee941a2bd6406485ed94addb766399d2
- TLSH T142416CDE50EC1644C75642F0AA50247BABCEBD0B0249B7C6EA8F0BFB51D20CDC2D9472
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pyviewc_sim\research\_pyviewc_arisco.log
- Size 3KB
- SHA256 3e91c33e50c5f4e653d2c55610aeb3680de549334b8ea87754e482fe0af205a1
- MD5 5ea0215de71862705bce3ecca1792208
- SHA1 646156b887fdb237f6951c9ae650958c97f4224f
- SHA512 3c020be75b45707b5a0ad059cfdf8c957103f018b46ad287d23f64997386a30e888f6d922d0d58a0ee8eb2ba19233d56b3193d1cbf1ad7dfc847ac671882b012
- TLSH T16C817CCE00EC1744C65582F0AA10656BABCE7C0B5109B7D6EA8F5FFB61D30CDC2A8572
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pyviewc_sim\research\_pyviewc_arisco.log
- Size 4KB
- SHA256 99e64083e5ce37e39e72ee34e9d33a93c4c1af323e24135eef04ad41d1b8f648
- MD5 6bfa1d4f88e31a1757696b65ac86ac54
- SHA1 af407f8fd6565a364483ee5a2f0c453dd37f60f6
- SHA512 74452741634aaf1c1c546bf142e0abb543476635229539bc0a558a65bbd8cbe19dd5a67ddddb4f19a0be1802af338aa173048c61d7f8467acc64704d31b2a382
- SSDEEP 96:AC4FI4Q0SUOe04eOi0cScv04Pp049SDenIb4ez04fSxq04LgSVYe4ed4hlA4JN6P:M7XPJeRZPX9jPelfQ8Mdr79JK
- TLSH T196915ACD10EC0644C69582F06A10656BABDE7D0B5109B7D6EA8F5FBB61D30CDC2E8472
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pyviewc_sim\research\_pyviewc_arisco.log
- Size 1KB
- SHA256 2adec84f6a69e3759289e33878292d3c2604fb6a8ba29f00b7674df914e118e6
- MD5 edcc530ee21a7a3ba72cab4b8db02260
- SHA1 ecdc52b6eb85a5ebee87bde7193c28d95e485fe1
- SHA512 ef5e0cb18f3364177efd5d4d599746e1e4cb16b77ed8f80f07c68d0796f546d31dd83a87e3367e177fbd3d76a513a4216fa52b6209357cc54c341e02f666cd03
- TLSH T1B02168DE50FC1A49C71682F06A10653BABCEBD0B0649B786E68F4BFB51D70CDC2D9462
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pyviewc_sim\research\_pyviewc_pump.log
- Size 4KB
- SHA256 750d411b2abed8bef6707f4d7b5f18ee466b310c2c89d577fe45d9678fb83b03
- MD5 850bbb402987a77bdc057338c9c2339c
- SHA1 d39e990c5542da39a2b95c810a17ba47976a9999
- SHA512 91f2f93639367e1ae51df8e36facf8911ee9a7b98d32989e16c02f04072eac9b2f13a2cc04f6846badbf2c50580319ab78f36a6eef2c85aac836b8742f1a2cab
- SSDEEP 48:PiAIpZCe+3bPEQL/lMvPawuI1d5iHLEQRNE2C4IBiEY6an2YaDAELd8RNyTEsJx:nuv0b7RMzviHvR0BMT32YaD5KRNyX
- TLSH T19991F6BD05A72F3DC1759B7C183285450EDD289447D0CAF3E53B8AC8963398C9328BE9
- MD5 SHA1 SHA512 SSDEEP TLSH