Overview

overview

7

Static

static

3

2026-07-12...ar.exe

windows10-2004-x64

7

2026-07-12...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
  • Size 10.8MB
  • Sample260712-te2d4scx5q
  • SHA256 84fe6427cb2f0e3951db3d709c2d057e139b786f37a353dbf22013a8334d7b3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\TEMP\{C857C6A4-BB16-4596-9A41-3A919238A138}\.cr\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
      "C:\Windows\TEMP\{C857C6A4-BB16-4596-9A41-3A919238A138}\.cr\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe" -burn.filehandle.attached=700 -burn.filehandle.self=704
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
        • Path C:\Windows\Temp\{C857C6A4-BB16-4596-9A41-3A919238A138}\.cr\2026-07-12_d7325a77ad08b15e5c9c11986194cbc5_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
        • Size 1.1MB
        • SHA256 6b1bf808e69abc5ce24a43e7a966f1d9c80f2e4c03c32c4ad9d14b397e398444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{E8D60EF9-8E3A-4893-9A19-945608FD057F}\.ba\5127\thm.wxl
        • Size 6KB
        • SHA256 4430c317024bfe7d8acac725dd9676348643a23868c0f65da7b60ce99d10e49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{E8D60EF9-8E3A-4893-9A19-945608FD057F}\.ba\5130\thm.wxl
        • Size 6KB
        • SHA256 44c02ac962d459652602dd44caf588036066b904b214eff11ef1cfac19bacb3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{E8D60EF9-8E3A-4893-9A19-945608FD057F}\.ba\5132\thm.wxl
        • Size 6KB
        • SHA256 f6ca06dbdd3247c4732e43299250c373b99a63b074898c99e084b73bf9d6d0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logoside.png
        • Path C:\Windows\Temp\{E8D60EF9-8E3A-4893-9A19-945608FD057F}\.ba\logoside.png
        • Size 16KB
        • SHA256 acc26b73a2cd7162821b8098ae192491ebd3c23ce41733aafb0913649d0280e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{E8D60EF9-8E3A-4893-9A19-945608FD057F}\.ba\wixstdba.dll
        • Size 365KB
        • SHA256 e2b2cbdce85f28352e7f742b276210ed9c4e69dea239d15f1e0b0a6004d416e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download