5dc8f4a94e11e4c25c845ee1775d658ca626e86b4b49eed64f3c98e1341158e6

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_ce7a244fb83e22bae9a1815d6f597e5a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 10.4MB
Sample261102-1853qaxta1
SHA256 5dc8f4a94e11e4c25c845ee1775d658ca626e86b4b49eed64f3c98e1341158e6
MD5 ce7a244fb83e22bae9a1815d6f597e5a
SHA1 b934049daca9646f8757f72916b66d298d956650
SHA512 0e8a5a65bd17e3e16a1fa2e64abcbbb61a03b602d89b311a1200cf446cde465ed61d8623abc87e016d7c26e4c21103a40c1b81be1121d86b546542cde3cc9f32
SSDEEP 196608:JzEkDd8M5SbpYJu0xc/1p4GOlH2pGtA3TX7aQMx3GdZR1QMrPEIWAVkTqvKJ:ikd8M5rJur/H4GOZCCA3TXWQMxWfUMzk
TLSH
T194B6331DEEB405F8E07BF1B85CC64063FBBA38460622974F07E996A61F172D09D79B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6024	升级程序.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	升级程序.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6024	升级程序.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 6024	760	2026-11-02_ce7a244fb83e22bae9a1815d6f597e5a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-02_ce7a244fb83e22bae9a1815d6f597e5a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ce7a244fb83e22bae9a1815d6f597e5a_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\子筑云升级\升级程序.exe
  "C:\Users\Admin\AppData\Local\Temp\子筑云升级\升级程序.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

升级程序.exe

Path C:\Users\Admin\AppData\Local\Temp\子筑云升级\升级程序.exe
Size 1.7MB
SHA256 36b3895bd62657a36109b233ea6fc26b1097640af311bb3340055ee3443996c5
MD5 d37ed77e91f9898cd629618b18ab4adb
SHA1 3b54e78e931c63c5f849c55b3a9125e2e22f89ef
SHA512 2f9145e03e23079d16fbf94c194b7fbbccf36607efd4896a85e42c94d232906a962434516a519d795271e36c51db835b9c35177df9e3c43f87b2337d230cef62
SSDEEP 12288:PBSheKQ0VoNKY65gnu6UlUoCwZzeZ3B/gCCFP5S:PHKQ0VOKt5gu9CwZzeZtCFP
TLSH
T1C78533027FE86048F5B79E3929F947564AE17C5D7CF9A83C2280B12D8C7295799B8333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download