Overview

overview

7

Static

static

3

2026-08-03...ra.exe

windows10-2004-x64

7

2026-08-03...ra.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
  • Size 4.4MB
  • Sample260804-p2bpraw1e1
  • SHA256 8c2fafe77d684966565f1827b3ac5616f3ab4aab0769ddd1aa516e2e7bc31f10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_216b986b42c4704fbd73697629b0f10d_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Users\Admin\AppData\Local\Temp\31002.exe
      "C:\Users\Admin\AppData\Local\Temp\31002.exe"
      2⤵
      • Executes dropped EXE
      PID:3468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 6.5MB
        • SHA256 0f8f77f94bc5b732588dd0208531544186c081f89c2a4cc3b0b2094749543636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        31002.exe
        • Path C:\Users\Admin\AppData\Local\Temp\31002.exe
        • Size 463KB
        • SHA256 9d138022dc64cf65ffce81928c7b76db61f8f047294578bd3e365b05a8a35f77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 a9ff8252b1f822ca6d1b9906b55f5e1b2c4b2e40b04c7d7ae72c45038e2583c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 d329ebd73446e1f1a0cafb8fd8c6934b59ac1c2e0d3fc9d1a6c532c801a6a1ac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 2a12d7865c524d5905b3344982a8f8dfa493d13fb6eec344a1d493e89f9ac666
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 db33f7d84a619d20745a68deb2e02a4fc834e7a20239a09612a0ef2cc21ef450
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 9116d5aa2ad5ea356b6fa34b950870d40eb342b03a29a447778758f66b6cc240
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 9130a044b181d0e5480bc7ead54be7819ed14906530b281cb176dadd9c326293
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 cb2655b556d126f063f3800d1df1852def5c6276369637ec1a5ef4b1f0259b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 16eed0bc9a9f1c7803b053fff083304a7a536b5321ec5ac50c9b2e0d18dd2810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 22e1505cca6aa57ed904edfb85429541a799fd2ff60442880872af1fbf50b61d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 696B
        • SHA256 e49ad1c32c3f25185d6fbca844abdc8b2f310180061665dad9594025d1bc970a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 551B
        • SHA256 e99ead8375229bf03b232834281be7d3ee5bed766d68e80b6479dee05e85c67a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 947B
        • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1328-229-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-231-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-232-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-233-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-234-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-235-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-236-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-230-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-228-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-227-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-226-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-225-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-2047-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1328-2051-0x0000000000400000-0x000000000040F000-memory.dmp
        Download