Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 01:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
- Size 13.0MB
- Sample260531-bfa97sfx4x
- SHA256 35be959667072e58196cfb92a8c6dc12be17f582ea4f6a1d4b7bd370bb7f66ee
- MD5 0333cba0783a978af39a112e2fdfd164
- SHA1 1c9bfe56560b658cdb9780705e82b71decd21d5e
- SHA512 d39ee2cd0aa6d4512e7ad9909152adb0e03b5c52ffb96c63de038d73321a83230a71ac6fb7ee9c8af8f97b0d697c5eed92bbc58d442a3afdd4309899229a8419
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qfo:Hk0+yNSJa0rW46AinMmtC3j
- TLSH T112D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 5 IoCs
resource yara_rule behavioral2/memory/672-1-0x00007FF6083B0000-0x00007FF6090BB000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/files/0x001700000002601f-3.dat INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/672-8-0x00007FF6083B0000-0x00007FF6090BB000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/files/0x001b00000002b451-12.dat INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/2760-10-0x00007FF61DCA0000-0x00007FF61E9AB000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal - Deletes itself 1 IoCs
pid Process 2760 JevkEOH.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
pid Process 2760 JevkEOH.exe - Loads dropped DLL 1 IoCs
pid Process 3260 regsvr32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe 2760 JevkEOH.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3076 cmd.exe 8 PING.EXE 2780 cmd.exe 2756 PING.EXE - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\ = "Debug Information Accessor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\ = "Debug Information Accessor w/o Global Memory Usage" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\ = "dia 2.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\ = "Generic StackWalker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR\ = "c:" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ = "c:\\msdia140.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64\ = "c:\\msdia140.dll" regsvr32.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 2756 PING.EXE 8 PING.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 2760 JevkEOH.exe 2760 JevkEOH.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2760 JevkEOH.exe Token: SeSystemEnvironmentPrivilege 2760 JevkEOH.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 672 wrote to memory of 3076 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 81 PID 3076 wrote to memory of 8 3076 cmd.exe 82 PID 672 wrote to memory of 2760 672 2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe 83 PID 2760 wrote to memory of 2780 2760 JevkEOH.exe 84 PID 2780 wrote to memory of 2756 2780 cmd.exe 85 PID 2760 wrote to memory of 724 2760 JevkEOH.exe 86 PID 2760 wrote to memory of 3376 2760 JevkEOH.exe 87 PID 3376 wrote to memory of 3260 3376 cmd.exe 88 PID 2760 wrote to memory of 4052 2760 JevkEOH.exe 89 PID 2760 wrote to memory of 2236 2760 JevkEOH.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_0333cba0783a978af39a112e2fdfd164_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\JevkEOH.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\system32\PING.EXEping -n 1 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:8
-
-
-
C:\Users\Admin\AppData\Local\Temp\JevkEOH.exe"C:\Users\Admin\AppData\Local\Temp\JevkEOH.exe" C:\Users\Admin\AppData\Local\Temp\IZ3JcAcx.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\IZ3JcAcx.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\system32\PING.EXEping -n 1 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c regsvr32 /s c:\msdia140.dll3⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\regsvr32.exeregsvr32 /s c:\msdia140.dll4⤵
- Loads dropped DLL
- Modifies registry class
PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2236
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IZ3JcAcx.exe
- Size 13.0MB
- SHA256 9862a2832b044675e22060a499479bde3e879f7daa662bf4651f032822211d63
- MD5 36304dbec9cb02b2203edb3438e5aae3
- SHA1 f30504e228ee55e00cedf5c35c9c0b60d8ce03e2
- SHA512 c3d33c85568e2139cf669692022c0714cfcfb2a4d4d9dd2be8ee39a39f396bdd6f529b305705f4e4bf53dc9493cc1dd0936b88873f751af61d11d92dd27a1f80
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44Qfw:Hk0+yNSJa0rW46AinMmtC3R
- TLSH T11CD6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\JevkEOH.exe
- Size 13.0MB
- SHA256 3c9ce25bfc9b13910ceddad76cf48cd8a3b4669eb7ac0b1cd250d77032bf6e6b
- MD5 9dfa2c5929f050de35758d176065f049
- SHA1 f229b3d00dffea8d0199dee35e77f0e1369efc71
- SHA512 e4753251eca8f5d73dd15eeb67f4e484250a97102f1254a9fd79a152eb1534d155232fc0cac65f22ba6fef3a724de88238e0fe9cb06106faf02f40b45903a8b9
- SSDEEP 196608:p5agcVBJsDuLyAJaSJWAjOU60iiW47HQdA73+wc2vx/zitV2R44QfP:Hk0+yNSJa0rW46AinMmtC3m
- TLSH T160D6BE1962D41219F1B39130DAB2C216E7737CD65B708B8F2ADE67035BB3AD19837329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\msdia140.dll
- Size 1.5MB
- SHA256 46351bd350799dc196481cbe2b26f628b489a280a9e2f49bace71930f3dc80d3
- MD5 73e0349829750676b7791ac210e304e8
- SHA1 38d8faa45f57ea050bff328bf0f23a8cd1f4e73f
- SHA512 7ae086c3dec0fb33a648cc2bd5fde69804b6b752e05c6ef4f45c00780b13ba086183a9adc4c432e38748d05c551107c3ab01fcbb8e29d966588a3ab220e4e311
- SSDEEP 24576:Rwx85I7xvZ6XlppppppLqrcQCGFV7FO8tiD/2ql5jszR25sb6:Rwr7xUScjuiJl5jszRA
- TLSH T1AF657D57B3B441A8D57AC138C71B9A06D7F374150311A7CF1AA147AABF2BBE61A3D320
- MD5 SHA1 SHA512 SSDEEP TLSH