Overview

overview

7

Static

static

3

2026-06-26...ar.exe

windows10-2004-x64

7

2026-06-26...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 11:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
  • Size 10.8MB
  • Sample260629-n29fcaes7q
  • SHA256 649335b287b26bc5c219e6a09381624ae75242703563e6145b0c42abb9937a3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Windows\TEMP\{143DBCD2-C4DB-49A6-AF65-CF79E3E055B1}\.cr\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
      "C:\Windows\TEMP\{143DBCD2-C4DB-49A6-AF65-CF79E3E055B1}\.cr\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe" -burn.filehandle.attached=632 -burn.filehandle.self=684
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      PID:4596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
        • Path C:\Windows\Temp\{143DBCD2-C4DB-49A6-AF65-CF79E3E055B1}\.cr\2026-06-26_d8523c4d0007dcebd674d86ea612aa19_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
        • Size 1.1MB
        • SHA256 55bf6e62317fee359d8bb07fd0fa77abe4f11923c500427019e8509d681538bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logoside.png
        • Path C:\Windows\Temp\{A06CA7C6-E0B4-4498-AC57-4D79F9545D0E}\.ba\logoside.png
        • Size 16KB
        • SHA256 acc26b73a2cd7162821b8098ae192491ebd3c23ce41733aafb0913649d0280e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{A06CA7C6-E0B4-4498-AC57-4D79F9545D0E}\.ba\wixstdba.dll
        • Size 365KB
        • SHA256 e2b2cbdce85f28352e7f742b276210ed9c4e69dea239d15f1e0b0a6004d416e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download