Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 01:57
General
- Target 2026-07-19_32988e3f2ee76bc56ecb50ca1fb4a02f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 669KB
- Sample260719-cdpkgsht9l
- SHA256 06adb82af57b6be239684ce7867ad1d7d212678660068122290302b253b3b488
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_32988e3f2ee76bc56ecb50ca1fb4a02f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_32988e3f2ee76bc56ecb50ca1fb4a02f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\2026-07-19_32988e3f2ee76bc56ecb50ca1fb4a02f_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\EnPortv.sysC:\Users\Admin\AppData\Local\Temp\EnPortv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EnPortv.sys
memory/4112-15-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-17-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-6-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-7-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-8-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-11-0x000002567A520000-0x000002567A53E000-memory.dmp
memory/4112-13-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-12-0x000002567A540000-0x000002567A5F2000-memory.dmp
memory/4112-14-0x000002567A600000-0x000002567A60A000-memory.dmp
memory/4112-18-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-4-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-16-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-1-0x00007FFBAD01F000-0x00007FFBAD020000-memory.dmp
memory/4112-19-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-20-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-21-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-22-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-23-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-25-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-26-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/4112-5-0x000002567A480000-0x000002567A4A2000-memory.dmp
memory/5620-28-0x0000000000010000-0x0000000000025000-memory.dmp