Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/04/2026, 02:53
General
- Target 2026-04-03_05672dbb119884a06e20faf648943fcb_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 1.8MB
- Sample260403-ddbjasf18q
- SHA256 fd90fdb1324417e7bcc558fae65c1bc73fc33598fa806638f672d546cf1c7f3c
Malware Config
Signatures
- Detects DonutLoader 1 IoCs
- Detects MythicApollo 3 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Mythicapollo family
- Custom signatureDetects executables manipulated with Fody 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-03_05672dbb119884a06e20faf648943fcb_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-03_05672dbb119884a06e20faf648943fcb_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4884-0-0x0000000140000000-0x00000001401DE000-memory.dmp
memory/4884-1-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-2-0x000000001AEF0000-0x000000001B0A6000-memory.dmp
memory/4884-3-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-4-0x000000001ADB0000-0x000000001AE04000-memory.dmp
memory/4884-6-0x000000001AE10000-0x000000001AE1A000-memory.dmp
memory/4884-5-0x000000001AE00000-0x000000001AE0C000-memory.dmp
memory/4884-7-0x000000001AE20000-0x000000001AE28000-memory.dmp
memory/4884-11-0x000000001AE60000-0x000000001AE6A000-memory.dmp
memory/4884-10-0x000000001AE40000-0x000000001AE4E000-memory.dmp
memory/4884-12-0x000000001B1A0000-0x000000001B308000-memory.dmp
memory/4884-9-0x000000001AE30000-0x000000001AE3E000-memory.dmp
memory/4884-8-0x000000001AD30000-0x000000001AD3E000-memory.dmp
memory/4884-14-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-13-0x000000001AEC0000-0x000000001AECA000-memory.dmp
memory/4884-15-0x000000001BA10000-0x000000001BA22000-memory.dmp
memory/4884-16-0x000000001BA30000-0x000000001BA6C000-memory.dmp
memory/4884-17-0x0000000002390000-0x000000000239C000-memory.dmp
memory/4884-18-0x000000001B310000-0x000000001B3BF000-memory.dmp
memory/4884-19-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-20-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-21-0x000000001AEE0000-0x000000001AEF0000-memory.dmp
memory/4884-22-0x000000001AEE0000-0x000000001AEF0000-memory.dmp