42318acca41b61893a7737ef6dbe9d65f342bd42c5d496d5356291250bb5087a

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 19:08

Target
2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc.exe
Size 266KB
Sample261101-xtds5sdb24
SHA256 42318acca41b61893a7737ef6dbe9d65f342bd42c5d496d5356291250bb5087a
MD5 e37e475961fd5cc18904ac8e17b3bb7f
SHA1 1b58297d2eeb842a0f865073756debf275be2c46
SHA512 879e0621def981b2bb8c4cfc3ff1b3218adfbeb3d02eb1eec9a6660d0226da899bba1993bdecb4552f014e4807ec14174f77ebfc312a6004faa5203165cadc7e
SSDEEP 3072:2IN+2LQJB0zBekFT6bK5Z4A55CRlheNvKrxHOY7D3ytdIaRIi7/0+/ipzBFdoD:/sMekd6bK/405tCOY7WagI3d
TLSH
T1D8446C1577A51CFAED67813DC9124906EB72BC474BA0E6CF13904BA61F23AE05E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4620	conhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4620	5072	2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc.exe	86
PID 4620 wrote to memory of 2140	4620	conhost.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_e37e475961fd5cc18904ac8e17b3bb7f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2140