Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 19:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
- Size 1.2MB
- Sample261102-x2bczscx81
- SHA256 5bbc48682fb5244146299792e9024f644819909d6cac84d688f32f771b9d84d9
- MD5 ea2f05386d3fc45ff6ae09cc9058187e
- SHA1 71592f26ab3b974056547064c0be9065501bbbde
- SHA512 fe8666d4b85a05543c2fda1f713908a3a95ddc34ad6a30d459d2c3d04471e3d702e46e5a8da1ceb668df111ead28169fab08c1880b7ceb0a6cf8aafdeb85f7e8
- SSDEEP 12288:lhDXbpk61EdwYPkqZzZAvJRfGJYR6rBwKhJfNZeXz2hJrvtWTcPPv4yjybzBXIyI:71qZzZAfR6FthtX2cPn4yjyd/He
- TLSH T10445AE0FFE8721EDC24AD8B457478AA7992138860725A9FB4EEC02712B756E05F3DF14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\shell\open 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\shell\open\command 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe\" \"%1\"" 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\ = "URL:frnhgnm Protocol" 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\URL Protocol 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\frnhgnm\shell 2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ea2f05386d3fc45ff6ae09cc9058187e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"1⤵
- Modifies registry class
PID:2384