Overview

overview

7

Static

static

3

2026-08-03...ra.exe

windows10-2004-x64

7

2026-08-03...ra.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_484b0f5343d947aa7a211c2623582e9f_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
  • Size 4.2MB
  • Sample260804-pbn76awscv
  • SHA256 ab5919a22779e07c65b9e38385141d577bc2114034cf72fd8caed1940e9bdf1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_484b0f5343d947aa7a211c2623582e9f_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_484b0f5343d947aa7a211c2623582e9f_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Local\Temp\41321.exe
      "C:\Users\Admin\AppData\Local\Temp\41321.exe"
      2⤵
      • Executes dropped EXE
      PID:5956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 6.3MB
        • SHA256 d493b06cf3cf3548c8929e63cdee1a78400202c0362b85f271385f53bf8c62a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        41321.exe
        • Path C:\Users\Admin\AppData\Local\Temp\41321.exe
        • Size 272KB
        • SHA256 74c692a290065d4d23bc59a9bd9655b5e47d535bf8942962dd8212e288b0e8e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 60B
        • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 963a0fd334dac781009e6fb1fba3b9fe333bec6130810d2b4084aeba0c93ef5f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 2KB
        • SHA256 4f387e377fce53e6fe98cf81799ba455a529fb66d3b38446fea7718b51eee0ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 9dbbd3d02f8f9dc5c26a485433fa2e2b8830acb16af8bf9677f77c2b89604452
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 ddb81b5f629342f37ec9008715e29974be609203a3a3405f2cce2c9417097991
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 7b5a3178337f8f05e2cbd1c961cd329d76674ae23696494fce6c73efff5157c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 3KB
        • SHA256 778e78b60bcea50613b5d1df01f39063a7b16d5da3609238b6aafeb17b20717e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 07bf5ad0e8f69444a9d3264b94c267778a20d97da4df9208ba60b0c25b8df932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 498B
        • SHA256 e293c0752f9cf1f008a18fdd22a0acfee1cc780f87f2c7941745c0ba805f2d0d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 90a6ed87ea1c8982378a2362cbff6a51c34b88e1804e6135ed66ef57b1f38425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 4KB
        • SHA256 cc14ffa575edcd24399a16e603cbafb60c283ffca9434ab21a983f6bde2e3b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 490B
        • SHA256 18ba32527517e6fb62192ed122825fb2aeff585a7f0419c8549b1c70012fc1be
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        log.txt
        • Path C:\log.txt
        • Size 1KB
        • SHA256 d891e4d110f0c2a1b3d030272ead7938ab7113876309255319b9c1e0b0bc6133
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4488-231-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-233-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-234-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-235-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-236-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-237-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-238-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-232-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-230-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-229-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-228-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-2056-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-5015-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/4488-5457-0x0000000000400000-0x000000000040F000-memory.dmp
        Download