Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 01:17
General
- Target 2026-07-19_70832899f307b18e961ce2f67f04d3d7_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe
- Size 4.7MB
- Sample260720-bnpgssdy2y
- SHA256 0e87c60ebe1983682a11cb0fa533823e02606674db0743f36d213ce8e724cf31
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_70832899f307b18e961ce2f67f04d3d7_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_70832899f307b18e961ce2f67f04d3d7_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_lynx_njrat_stealc_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks.exe /create /tn "KvDjYBkP.exe" /tr "\"C:\Program Files (x86)\ZRmdNbrSMm\KvDjYBkP.exe\"" /sc onlogon /rl highest /ru BUILTIN\Users2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 7282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4480 -ip 44801⤵
-
C:\Program Files (x86)\ZRmdNbrSMm\KvDjYBkP.exe"C:\Program Files (x86)\ZRmdNbrSMm\KvDjYBkP.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 5522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4168 -ip 41681⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
KvDjYBkP.exe
memory/2916-1-0x0000000000620000-0x00000000006D9000-memory.dmp
memory/2916-3-0x0000000073D92000-0x0000000073D93000-memory.dmp
memory/2916-5-0x0000000005D80000-0x0000000005E3C000-memory.dmp
memory/2916-6-0x0000000073D80000-0x000000007453C000-memory.dmp
memory/2916-7-0x0000000073D80000-0x000000007453C000-memory.dmp
memory/2916-8-0x0000000005F40000-0x00000000060E4000-memory.dmp
memory/2916-9-0x0000000073D80000-0x000000007453C000-memory.dmp
memory/2916-11-0x0000000006700000-0x0000000006D18000-memory.dmp
memory/2916-10-0x0000000073D80000-0x000000007453C000-memory.dmp
memory/2916-36-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-41-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-73-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-100-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-115-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-125-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-135-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-137-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-133-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-131-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-129-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-127-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-123-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-121-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-119-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-117-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-113-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-111-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-109-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-107-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-105-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-103-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-97-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-95-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-93-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-91-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-89-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-87-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-85-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-83-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-81-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-79-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-77-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-101-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-75-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-71-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-69-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-67-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-66-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-64-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-61-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-57-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-55-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-53-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-51-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-49-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-47-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-45-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-43-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-59-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-40-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-37-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-33-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-31-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-29-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-27-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-25-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-23-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-21-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-19-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-17-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-12-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-13-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-15-0x0000000005F40000-0x00000000060DE000-memory.dmp
memory/2916-1614-0x0000000000620000-0x00000000006D9000-memory.dmp
memory/2916-1872-0x0000000073D80000-0x000000007453C000-memory.dmp
memory/2916-2090-0x0000000073D92000-0x0000000073D93000-memory.dmp
memory/2916-6775-0x0000000006160000-0x0000000006168000-memory.dmp
memory/2916-6776-0x00000000065B0000-0x0000000006616000-memory.dmp
memory/4480-0-0x00000000026B0000-0x000000000276B000-memory.dmp
memory/4480-4-0x00000000026B0000-0x000000000276B000-memory.dmp