Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
- Size 3.0MB
- Sample260416-rcaghacw4x
- SHA256 3645ca38aaebe8622d27d0097f92da8d226a4a8cae72cda47000818795a5f16a
- MD5 0229cdcbf798c79868233a175eb6aff5
- SHA1 7968323dfabdc18838bf5bef24732dc28ff5072c
- SHA512 ba965c28ae00336c7e9b6abec9a85fc7a69cd097445e649cb6a1795b721f496a0117a339d2cb47bdff37af836528bd13e9e594542384a95bd28659ead2f7eba7
- SSDEEP 49152:yrE3ZPItN+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyP:iDto0oAaldmdmnpP
- TLSH T1D1E53803A29544E9D15AC078CE46C232EB627C5D4BF265EF36907AD63E77AD03B3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2108 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.sho - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shohdi.hdi 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.sho 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.shoC:\Users\Admin\AppData\Local\Temp\2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.sho2⤵
- Executes dropped EXE
PID:2108
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.sho
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_0229cdcbf798c79868233a175eb6aff5_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.sho
- Size 2.5MB
- SHA256 aa395ee3b33142bd96382709c515f321d122e2499f773a457868c8666c9177a2
- MD5 d3e37d1f3304ab7edaa2e4d3ac183980
- SHA1 af8a6e7216f67ca5d220084d07e1ed922ac72817
- SHA512 72815d826b7bedef9320b9d6c3476b94491d8e804f48b9cc1ff6e03901d771d0ec008f2f763088517f0a3858a23c6cfd4bf3fe7fa1788aed04d328299559c4e6
- SSDEEP 49152:B+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky:80oAaldmdmnp
- TLSH T1F3C53803A19948D9D15AC074CE46C231EB227C5D4BF265FF3690BADA3A77AD03B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Shohdi.hdi
- Size 3.0MB
- SHA256 b24255fd880a15fff79b6614ccfe558ceabca62ff36458cd6e05c70783e01a55
- MD5 81ef9be7456c798367c4ee745e6a4b9b
- SHA1 769c1d703fbd7647e100dd08316ac059ef8f3a6f
- SHA512 46c65af7edde6538781f560573cfdba03759dc6ed03ec469b076a05fad5778bff5cd89f1557467a49d69624f842771d59b23a3fe9ab5c1f4f071ebdba9b2fec3
- SSDEEP 49152:srE3ZPItN+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyP:0Dto0oAaldmdmnpP
- TLSH T122E53803A29544E9D15AC078CE46C232EB627C5D4BF265EF36907AD63E77AD03B3A710
- MD5 SHA1 SHA512 SSDEEP TLSH