Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 10:08
General
- Target 2026-07-05_ae0efd7163406cf65296428f6f68fcb8_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
- Size 2.1MB
- Sample260705-l6gvsafs8l
- SHA256 0b42e53de63f8652a5b7e6b637bd510314280df8a7f9d2a78c0bc9cd0cd86eb0
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_ae0efd7163406cf65296428f6f68fcb8_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ae0efd7163406cf65296428f6f68fcb8_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4264-0-0x0000000140000000-0x000000014021D000-memory.dmp
memory/4264-2-0x0000000140000000-0x000000014021D000-memory.dmp
memory/4264-3-0x0000000000F80000-0x0000000000FA0000-memory.dmp
memory/4264-4-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-5-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-6-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-7-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-9-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-8-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-10-0x00000000010F0000-0x0000000001110000-memory.dmp
memory/4264-11-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-12-0x00000000011D0000-0x00000000016B7000-memory.dmp
memory/4264-13-0x0000000001110000-0x0000000001130000-memory.dmp
memory/4264-14-0x0000000001110000-0x0000000001130000-memory.dmp