Analysis
- max time kernel
113s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
- Size 3.3MB
- Sample260417-sethtsc12t
- SHA256 be036a1ef8fd4d0b2e03c48b48731f8de3821b6df1ae6385d597a1a44ff3d7e0
- MD5 4a786b24cf7fbc89653d74307a876aec
- SHA1 067c8df376abcb4ae3378de2ad35884225f194df
- SHA512 cf8595b30f38f3077b6787f22a7fc1f516565e42f3c458983a63d0a1af119171c53c15a1b2804a88fd1d19cf2d8343e5e09bf8b3bd76912655834fa4ce90c463
- SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lu:b9M9ReUJF3noxD255zjoT5ta1S
- TLSH T1E3F56D01F65046F9D4268131CA91626DB6777C118762DE8B1398EEACBFF29D09D3A333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2708 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4140 2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe 2708 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_4a786b24cf7fbc89653d74307a876aec_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4140
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 be036a1ef8fd4d0b2e03c48b48731f8de3821b6df1ae6385d597a1a44ff3d7e0
- MD5 4a786b24cf7fbc89653d74307a876aec
- SHA1 067c8df376abcb4ae3378de2ad35884225f194df
- SHA512 cf8595b30f38f3077b6787f22a7fc1f516565e42f3c458983a63d0a1af119171c53c15a1b2804a88fd1d19cf2d8343e5e09bf8b3bd76912655834fa4ce90c463
- SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lu:b9M9ReUJF3noxD255zjoT5ta1S
- TLSH T1E3F56D01F65046F9D4268131CA91626DB6777C118762DE8B1398EEACBFF29D09D3A333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 77c4272616d1105d715a69398ee8752c9ccc00dc7288031b6eed1a183f892155
- MD5 39caef92a87e7cab19671d93af4a6d86
- SHA1 2b4208a693000ab743df84b2a0c131acd75fe629
- SHA512 a1ba947e420302a4cf380c7bf4fecd6a12cf27a5073f5bb12596343dac5e862efd334efb830f0a47a82780ae4412abf0720916111965b59becbf624dfd38dc66
- SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1LePji0Aj:b9M9ReUJF3noxD255zjoT5ta14jo
- TLSH T197066D01F65043B5D4668135CA91626DF6723C518722DECB1398EEACBFB3AD19D3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.3MB
- SHA256 69af6136e0133e68aa76456eae5aeee321da38776a89843388e72d2e77f537c6
- MD5 b04ea0e27ec84aaf0fc29f09b5b57ea7
- SHA1 fda6a6e54a1b607e082205ddf3dc0a4a4a15f7f8
- SHA512 ad590e6dbbe59feea7c2198c9394b90956da836386f2cdba630e4a061c959c8b355a72b8735281ab5d6c2570b6252323fec42e0c01e2e1a52c040c7aaabe4d93
- SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1Lm:b9M9ReUJF3noxD255zjoT5ta1C
- TLSH T1C6F56C01F65042F9D8664131CA95626DB6767C118722DE8B1398FFACBFB29D09D3A333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python3.exe$
- Size 3.5MB
- SHA256 61a091909571cfd029347833f29d0890f601bc0a86a361c63ae8f20d239de1d2
- MD5 d9675f89badd0994858301df5fedc291
- SHA1 35fd8084ed050ccffcbec0aabb8431ce9bd9a344
- SHA512 41d5a941f7c12e2797d3bb83d8582c9f32d470f55f8ca8e3aac983a3859838c85b8fb775bc58dcb1e392252a57a9fa5e025a2295828be279da8b3acb129f0867
- SSDEEP 49152:Dv9Mdv9MRs8xmN3Aek03noj45wlDTn35DMnCIjtAyVPji0AjP5ta1L8i2WH3:b9M9ReUJF3noxD255zjoT5ta1AuX
- TLSH T18C067D11F65042B9D4264131CA95627DB6767C118722DECB1398EEACBFF2AD09D3A333
- MD5 SHA1 SHA512 SSDEEP TLSH