6b184e5cf6df12438298edcd00f68a849b251cb453241acae77b4566c3d57afa

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:15

Target
2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 385KB
Sample261101-16bfbsdw31
SHA256 6b184e5cf6df12438298edcd00f68a849b251cb453241acae77b4566c3d57afa
MD5 9eae7f4d6bf302bb03bfaa09116935d6
SHA1 0d1aeb0398ba7b679c3836ecd034a25c18b260f4
SHA512 854d07fc8c66af61b2047677dac690ae0910148d0d0556ae197dceda72a257580d1197d43d1bb7b99c6c36fd57cd4fa5b56a0df5e1468cd063dab2768e63d120
SSDEEP 6144:CZE59G3WB0kzbveoRdUo47Pwbz9q76tOqtoAYJ5WlXqHYeG8RX:oWd3lEoQPwbza+jtdYJUtqHYeV
TLSH
T1A4847C5AE7A414F9E1B7D538C9724506EAB17C9907B0D6CF23A40A9A0F337E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4512	2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9eae7f4d6bf302bb03bfaa09116935d6_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5876