9cc3093c609f8e9cd414a36721fb762395ec053c977cf6ffa94156c8bcd41711

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
Size 13.0MB
Sample260702-cplmzaa18x
SHA256 9cc3093c609f8e9cd414a36721fb762395ec053c977cf6ffa94156c8bcd41711
MD5 20e918c140290634b8c2c29ec1e9bdf4
SHA1 69f195c597deec2270f9801aed8316472951257e
SHA512 edbcf07383a1339a2284ac58fdc32234105354fe6819ca899cd88abd31359461ebef1bbc00f11d72389ddbee4409f9321e67b58bb748595cdba3e9547a2c25b5
SSDEEP 196608:zx5agcVBJNwGYjARtBDghwrU7EDs+W4BJF:bkVe88bS
TLSH
T125D6BE2562D4131DF1A39530DAB2C216E6737CD65B708B8F19DAA7036FB3AD19833329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 5 IoCs

resource	yara_rule
behavioral2/memory/3452-1-0x00007FF61DBE0000-0x00007FF61E8EF000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal
behavioral2/files/0x000e00000001c58d-4.dat	INDICATOR_SUSPICIOUS_USNDeleteJournal
behavioral2/memory/3452-5-0x00007FF61DBE0000-0x00007FF61E8EF000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal
behavioral2/files/0x000d00000001c58f-10.dat	INDICATOR_SUSPICIOUS_USNDeleteJournal
behavioral2/memory/2936-8-0x00007FF73CD30000-0x00007FF73DA3F000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal

Deletes itself 1 IoCs

pid	Process
2936	rj9eJT0.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2936	rj9eJT0.exe

Loads dropped DLL 1 IoCs

pid	Process
5584	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5068	cmd.exe
2984	PING.EXE
4796	cmd.exe
4292	PING.EXE

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64\ = "c:\\msdia140.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\ = "Debug Information Accessor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\ = "dia 2.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR\ = "c:"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ = "c:\\msdia140.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\ = "Debug Information Accessor w/o Global Memory Usage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91904831-49CA-4766-B95C-25397E2DD6DC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\ = "Generic StackWalker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ = "c:\\msdia140.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6756135-1E65-4D17-8576-610761398C3C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ = "c:\\msdia140.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CE4A85DB-5768-475B-A4E1-C0BCA2112A6B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64	regsvr32.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2984	PING.EXE
4292	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
2936	rj9eJT0.exe
2936	rj9eJT0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	rj9eJT0.exe
Token: SeSystemEnvironmentPrivilege	2936	rj9eJT0.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5068	3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe	89
PID 5068 wrote to memory of 2984	5068	cmd.exe	90
PID 3452 wrote to memory of 2936	3452	2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe	91
PID 2936 wrote to memory of 4796	2936	rj9eJT0.exe	92
PID 4796 wrote to memory of 4292	4796	cmd.exe	93
PID 2936 wrote to memory of 2876	2936	rj9eJT0.exe	94
PID 2936 wrote to memory of 1704	2936	rj9eJT0.exe	95
PID 1704 wrote to memory of 5584	1704	cmd.exe	96
PID 2936 wrote to memory of 5808	2936	rj9eJT0.exe	97
PID 2936 wrote to memory of 1232	2936	rj9eJT0.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_20e918c140290634b8c2c29ec1e9bdf4_amadey_cobalt-strike_fabookie_icedid_luca-stealer_njrat_.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\rj9eJT0.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\PING.EXE
    ping -n 1 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\rj9eJT0.exe
  "C:\Users\Admin\AppData\Local\Temp\rj9eJT0.exe" C:\Users\Admin\AppData\Local\Temp\I7XTTQT9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 1 localhost&echo %random%>>C:\Users\Admin\AppData\Local\Temp\I7XTTQT9.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\PING.EXE
      ping -n 1 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c regsvr32 /s c:\msdia140.dll
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\system32\regsvr32.exe
      regsvr32 /s c:\msdia140.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

I7XTTQT9.exe

Path C:\Users\Admin\AppData\Local\Temp\I7XTTQT9.exe
Size 13.0MB
SHA256 9d3faa1d2beb0d7e1a20069457669d916988a20f3375063860eec91d9ab8f441
MD5 6e5ffc4384b5b0b0a24c2db66d16e68a
SHA1 c032547dfc2be0004c354879499501a660414afb
SHA512 26502d4813c262c868cf3af1f57a818a31415907abb47b2e717ce942ba40eeee1d464b7c61381780d74548a4e058befce0a5d7f2132b81a1e51934b35623cd22
SSDEEP 196608:zx5agcVBJNwGYjARtBDghwrU7EDs+W4BJ7:bkVe88bS
TLSH
T185D6BE2562D4131DF1A39530DAB2C216E6737CD65B708B8F19DAA7036FB3AD19833329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rj9eJT0.exe

Path C:\Users\Admin\AppData\Local\Temp\rj9eJT0.exe
Size 13.0MB
SHA256 6ca15f615b06b18ef1227e3bb6f3e010efbab6239c99407d2647e1217d8c6776
MD5 6bd486fdb639b78c45ad46c345ee5ffc
SHA1 ca4ef1cca59409bc77a258fc2b255d72205253d9
SHA512 edd4d3d9900f3c15bd285d341f159ccc6cdcb9db0fd12636b6b4d1149f11ef47908c5f44be7f62fdfa9d8a4975e1760ed90bce4d49b928e5e638d487deb2db4a
SSDEEP 196608:zx5agcVBJNwGYjARtBDghwrU7EDs+W4BJV:bkVe88bg
TLSH
T17FD6BE2562D4131DF1A39530DAB2C216E6737CD65B708B8F19DAA7036FB3AD19833329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdia140.dll

Path C:\msdia140.dll
Size 1.5MB
SHA256 46351bd350799dc196481cbe2b26f628b489a280a9e2f49bace71930f3dc80d3
MD5 73e0349829750676b7791ac210e304e8
SHA1 38d8faa45f57ea050bff328bf0f23a8cd1f4e73f
SHA512 7ae086c3dec0fb33a648cc2bd5fde69804b6b752e05c6ef4f45c00780b13ba086183a9adc4c432e38748d05c551107c3ab01fcbb8e29d966588a3ab220e4e311
SSDEEP 24576:Rwx85I7xvZ6XlppppppLqrcQCGFV7FO8tiD/2ql5jszR25sb6:Rwr7xUScjuiJl5jszRA
TLSH
T1AF657D57B3B441A8D57AC138C71B9A06D7F374150311A7CF1AA147AABF2BBE61A3D320
MD5 SHA1 SHA512 SSDEEP TLSH