c7e7266f5d037cdc7f00ae106ba3f49a34106263d5c87985c07112692b40f7e4

Analysis

max time kernel
12s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
Size 298KB
Sample260720-tln3csfx9p
SHA256 c7e7266f5d037cdc7f00ae106ba3f49a34106263d5c87985c07112692b40f7e4
MD5 2a7e19a2a92521484f276cefe6ad2ec2
SHA1 094e2b429674f533dd60649b076a5fc4d8bb0da8
SHA512 368b585131fae7e3c085553aa1b0b07b09db5f09e91b095d091e478fc88e126e71bbd771997b025ed91fd25101b976aa67c6571d0c25b7e67537eff23fb061fa
SSDEEP 3072:86jI9XJy7ripnGeRz3KFFfQku+5pSlQ5VmFMPyW4UnLJm3XnVVMHxarvYY3Qih80:fUZyaGQOF1vf5pS8Vb6IJ6noeL3X80
TLSH
T10A54080162E48FA4F5BF263E8860456996377C61CE36C7CF22507E5B7E336429D2A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5604-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c36a-7.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5604-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3980-16-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2016-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c36c-21.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3352-22-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6060-23-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c36a-7.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c36c-21.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
6060	MSWDM.EXE
3352	MSWDM.EXE
4512	2026-07-20_2A7E19A2A92521484F276CEFE6AD2EC2_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_LUCA-STEALER_NJRAT_VIDAR.EXE
3980	MSWDM.EXE
2016	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\devBE79.tmp	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\devBE79.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	MSWDM.EXE
3352	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 6060	5604	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe	89
PID 5604 wrote to memory of 3352	5604	2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe	90
PID 3352 wrote to memory of 4512	3352	MSWDM.EXE	91
PID 3352 wrote to memory of 2016	3352	MSWDM.EXE	95

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6060
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devBE79.tmp!C:\Users\Admin\AppData\Local\Temp\2026-07-20_2a7e19a2a92521484f276cefe6ad2ec2_cobalt-strike_elex_icedid_ipamor_luca-stealer_njrat_vidar.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\2026-07-20_2A7E19A2A92521484F276CEFE6AD2EC2_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_LUCA-STEALER_NJRAT_VIDAR.EXE
    3⤵
    - Executes dropped EXE
    PID:4512
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devBE79.tmp!C:\Users\Admin\AppData\Local\Temp\2026-07-20_2A7E19A2A92521484F276CEFE6AD2EC2_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_LUCA-STEALER_NJRAT_VIDAR.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2016

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-20_2A7E19A2A92521484F276CEFE6AD2EC2_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_LUCA-STEALER_NJRAT_VIDAR.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_2A7E19A2A92521484F276CEFE6AD2EC2_COBALT-STRIKE_ELEX_ICEDID_IPAMOR_LUCA-STEALER_NJRAT_VIDAR.EXE
Size 298KB
SHA256 d2a3fe704b3a542cd131cfbad4ba59f492660aadc590a855f83191aaf61488ea
MD5 b09de3a15a96d7fa3d1589531e5ce913
SHA1 aa2118fa0d75e38332e49b415b46a3875db0e462
SHA512 12f99eed39ae92f30a4b60c0a67a0c67fd1f7de98313b4d4eec65114260164eaacfcd5ed5a7cb60d348d964a03d20a72f158b99d9698dacad30e0b262e41f26e
SSDEEP 3072:86jI9XJy7ripnGeRz3KFFfQku+5pSlQ5VmFMPyW4UnLJm3XnVVMHxarvYY3Qih8l:fUZyaGQOF1vf5pS8Vb6IJ6noeL3X8l
TLSH
T14A54080162E48FA4F5BF263E8860456996377C61CE36C7CF22507E5B7E336429D2A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 0d165541b30bd404ff88eb11fc7afcbb333f59405d28118ff8b0ad93a4e6afb2
MD5 1f1ef3f5191f857e0ce7b8522125f368
SHA1 e6f52293414d5638d72e02cd44bc1123b1bda623
SHA512 3278bec3fd899361ac1b5b1596c43e2dfb6514ea1f8f906508d368816368f182966bb5b78dd950fdf19eacd3fd30e685c7bd6849682cfda42cf721dd7fe89652
SSDEEP 768:JdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRiH:3STjtALMd6bE9XJuFrvJ70z+iH
TLSH
T10A83141A2609CF69F19F213FC8A6A5EC122B6C39DD330BD73950BE1BB4722476987153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devBE79.tmp

Path C:\Windows\devBE79.tmp
Size 218KB
SHA256 59e5ae1e99c6a4ccc01e8abdc2534210ec5faa945754a89524b06381da8c20a1
MD5 6a4e049d8c497d350a7bd54dfff99808
SHA1 7f1d32424c961542ae172c5b8c1611291c30fc4f
SHA512 41169089fa67e1a0ff1360dc5428b89dcee0d642204ddb7dac80d6cf859caae3c2b14fa89ce72072fb780c0a93f53eb0ff9414a8e88b1d783bfa75c9c4ea353d
SSDEEP 3072:JnGeRz3KFFfQku+5pSlQ5VmFMPyW4UnLJm3XnVVMHxarvYY3Qih8KjzY:JGQOF1vf5pS8Vb6IJ6noeL3X8X
TLSH
T19B24481173E505E8F5B76B3489704516EA777C624A34DB4F03A482AA9F73B80DE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2016-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3352-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3980-16-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5604-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5604-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6060-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download