Overview

overview

7

Static

static

3

2026-08-03...ra.exe

windows10-2004-x64

7

2026-08-03...ra.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
  • Size 4.4MB
  • Sample260804-p2bpraw1e1
  • SHA256 8c2fafe77d684966565f1827b3ac5616f3ab4aab0769ddd1aa516e2e7bc31f10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Users\Admin\AppData\Local\Temp\31002.exe
      "C:\Users\Admin\AppData\Local\Temp\31002.exe"
      2⤵
      • Executes dropped EXE
      PID:3488

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.3MB
        • SHA256 caaca3f01d9c43ea0d526685f821d7dea6f16975c384c5ca2a11acd023b35097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        31002.exe
        • Path C:\Users\Admin\AppData\Local\Temp\31002.exe
        • Size 463KB
        • SHA256 9d138022dc64cf65ffce81928c7b76db61f8f047294578bd3e365b05a8a35f77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 947B
        • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 f3f24c181e31641ae51767c4442499a5c53f11f2152ac05ce9f88ead88c9072e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 96b8bf137b89f66d51cdb285c2fac35d10a2f3cda7ac8ced3b940ee10b24f7d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 e8be97e3e8a181c8d1a2d5f27bccb1cda79cf7a9fa7dc49f36f8caf6aec058b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 79bba340a7580d9764dafd21037be09a4166e0b6fcdaa26172cc6cc2d6d5a939
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 d1face33ee48970b0f3e86dff905862c7799ba7f37f3b2f947fbd428df78f84c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 b40cc9c3fb7270bd8af4738115a0b6662d6458ece39bce6bf218ca1c891820de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 ad4c5c845a8610ef193ad2275646931e4e39488741171eee2f415ddbc88b6a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 408B
        • SHA256 c95625c6df6dbfc2397665037e01b810f9c80b5107a364dc3332bc1a201c36e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 748B
        • SHA256 6348c0fd32a67393b920add3df4faf54b652e5087f185daeb9cff01e7c725694
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/844-245-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-253-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-248-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-249-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-250-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-251-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-252-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-247-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-246-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-244-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-243-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-242-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-2107-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/844-3483-0x0000000000400000-0x000000000040F000-memory.dmp
        Download