neshta | ace193db0988128117c073a53cc19c40d6ce8065d3bfc2bb819b9c95d07a0688

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
Size 423KB
Sample260804-rasv3abh29
SHA256 ace193db0988128117c073a53cc19c40d6ce8065d3bfc2bb819b9c95d07a0688
MD5 d65c3cbad0cdc53d7b38e259d352892c
SHA1 e4591c0c10f7997030da39b69de0f9f7d91ca4f5
SHA512 1f03b3cd0e9a2b9ce83645a9ee62b1bd2e3a3dc77a2c780cd2d144e0a65f6d0fb2f768dafef612c5cedfdae8343d2ac55debb6dd40ff57bb70fa6c52b9f5b95a
SSDEEP 6144:k96YnQRtqiSG4jwzjI1G9dpjPMRZf4A1eOJrYhIjJ041R1kVIGC1ZL:rFRtqiSG4jwzcovrM4qeOJrYelwoZL
TLSH
T1FD94AE41F6A004F6D1B39138C8954656E7727CA543709BCB63A8ABA63F333E01E3D7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 8 IoCs

resource	yara_rule
behavioral2/files/0x0007000000018926-18.dat	family_neshta
behavioral2/memory/3284-139-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3284-140-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000d00000001c514-171.dat	family_neshta
behavioral2/memory/3284-179-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3284-181-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4304-182-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4304-226-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	5572	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Executes dropped EXE 4 IoCs

pid	Process
5572	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
4304	svchost.com
3412	2026-0~1.EXE
4628	NexonLauncher64.exe

Loads dropped DLL 4 IoCs

pid	Process
3412	2026-0~1.EXE
4628	NexonLauncher64.exe
3412	2026-0~1.EXE
3412	2026-0~1.EXE

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpCmdRun.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c51e-187.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	2026-0~1.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NGM.exe = "11000"	2026-0~1.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NGM64.exe = "11000"	2026-0~1.EXE

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\ExcludedApplications	NexonLauncher64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	NexonLauncher64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	NexonLauncher64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	NexonLauncher64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting	NexonLauncher64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\ExcludedApplications\NexonLauncher64.exe = "1"	NexonLauncher64.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 5572	3284	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe	90
PID 5572 wrote to memory of 4304	5572	2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe	91
PID 4304 wrote to memory of 3412	4304	svchost.com	92

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE" -490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE -490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      PID:3412

C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashReporter_64.dll

Path C:\ProgramData\Nexon\NGM\CrashReporter_64.dll
Size 1.4MB
SHA256 3f676a3df1267fc6e7b84f8ca39f4ff04f5cacb849f48dbb58d481a608f7ae11
MD5 155b3f2de11afc89740d6681145c5efd
SHA1 6efae666f24bdb7ffa9ca990ee516e3b58ae1941
SHA512 4b6ef3cd75b5c2f7a50a933d0e2a6e521f7b2ee24521db62f99afbdc8f0b0ea08ad1abb613d52770555f864c8155971a05d730ad7c9ad2cca73fbb875bdb0684
SSDEEP 24576:REK3nRwLqyg+0tr0YFIYOsvdHB+Dtc0J0lrCz8f/ML:KK3nRsq60trDFIY1dHBYtc0J0lWz8sL
TLSH
T1E6656C1A76588174D177C27CC9978A8AE6B274025F31DBCF16A8475E2F37BE0463E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NGM64.exe_0.tmp

Path C:\ProgramData\Nexon\NGM\NGM64.exe_0.tmp
Size 385KB
SHA256 3a43ca3c66dcfcadf1933a356a1e919759644cdd8f059e0c5a35d5d626120732
MD5 9486febaa4bebde7cc9f9afd8b669c97
SHA1 b7092d576f8d03bd76ae18873fa1342ccf927050
SHA512 c551fc544fa699aa9306cd4e999d57fc511d270fb4b0357c35c493dcbd63b20bcff621d9e5ed54e98a3e03d6ec3c5548b7399c210a3144ebfed7c5cf8dc0d5c2
SSDEEP 6144:gT7XbYQGfc7vOObY0qgB9IjGuBdEgSqGS/1UtZeil3nXYSTcYS10S1g1Wq:iL0rcbOObYY9IjxdZlAZeitnXNch1Bq
TLSH
T1AB849E41F6A404F6D5BB9178C895890AE7727C6907B0DBCF23A496662F333D01E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NGMDll64.dll

Path C:\ProgramData\Nexon\NGM\NGMDll64.dll
Size 7.6MB
SHA256 16f1e3c343353edb71c250d844f60d06c7e89d1a424f0a09fe52b8701ba20bc1
MD5 cfb7cb7e1c83e814632a6775234b7f3e
SHA1 c83fc3367090073b289430fb6a88c1c4213902ac
SHA512 05050aa898a814092cdecb16f49c1cface7e7cc236482d3cd4da6d46101cc6b68ad4f9e325dea63b8779c306a4be99c4b7a7c59030fd00871574432783b96936
SSDEEP 98304:V+zW1d715XDKlow44SBDcqJJBaFu06bjzQflGMORHHnQVKU:V31P5XDKloxvBDcqJqFu06bjzQ9GZRna
TLSH
T168869D6972BC0065E4BAC1BCC697A217D7B2B45617B097CF166087FA1F23BE11A7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NGMResource.dll

Path C:\ProgramData\Nexon\NGM\NGMResource.dll
Size 1.3MB
SHA256 0e6e6961d7b68f11ddd9cc2ac31532f5a461ce31d87c4cf5d9d47b9891087c74
MD5 d4f5d7c9fc102448dbf2fa5fc194db5f
SHA1 af51d5c5d60b0126302ec48f58e1c20477dda2d1
SHA512 f14a021ccb792e2eb1f69ba2fdf0d3d68166b150810d4a5bb173a8e909a4286b5a41ec99f5850268cefaccde014e178a72a86817a3d850608ff962f9ca921ab7
SSDEEP 24576:vtCoUPlFrsjuAnln5wVEtnwoZh5oZkPJZ0LEUmB8U2wXL2CHWmXD:AoGlFojPl5wCtnwodoZ0JZymB6wHHZXD
TLSH
T1F1551285A7E1040AF4F76B7154B6D5220F33FCA1A6B4EB5CB48E601DAB30B509CB4767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\Nexon\NGM\WebView2Loader.dll
Size 158KB
SHA256 28b898e4433291c969cd4f3bc46377b195527ad9138df2fa57243ceb6717a6b9
MD5 8838e584de6b554189da0297b36afd2b
SHA1 3fd613f6c14b484446c71aa651d2cca2c3515e2c
SHA512 57984d7c948a2535c25ee01703e7dbe208768f9a8711392928107c603d2158a224ecb6f4a25c3e6e5c60eb13d08aed8f921770af0d55a3376647db1cc7a7978d
SSDEEP 3072:QtWvF4bCEAJ1/fEyClkpOpji64PsvI8SCOT9dEt+NsgYjzbU:mWKY1/sygQi4skEtTA
TLSH
T1DDF35B57B3E400BBE1678274C9938A16E777B8110B50ABDF03A4476A1F237D4AE3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nugu64.dll

Path C:\ProgramData\Nexon\NGM\nugu64.dll
Size 2.7MB
SHA256 abd1766290a755d0f8d0eabab7967de07d920f53d4034fab77586dc6b8ba4239
MD5 eec8008acc85fc683105da35c2ca636d
SHA1 3cb002ee08abe3ebdc2edb270d43c1977199893f
SHA512 d7d58d74d0cd329e35a046e45ff0fb70a1f6f53c0bff5e925c45bf71f79a1a24efb936fc556e51eb94a38139b7fa0b1caa2d8057a41a1d831560785029dfff4d
SSDEEP 49152:Ahb41DblUzL91ffNcxgnxIBWJcUtnZsM9jXHs3/Av0SbF+TMm5l1n+6jle:AFAlUNRNGgxIBWaQvxXsPW0SbF+9XBjU
TLSH
T18FD533B29C17467FC9C619B120A8F8512A48B604FBFC814F7466B309F82A727877D7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashReporter.dll

Path C:\ProgramData\Nexon\NexonLauncher\x64\CrashReporter.dll
Size 696KB
SHA256 649ac7107e3efca55b69208a32d97dee64285b2b6f2f1e99cdc0e45a8bc3f501
MD5 fc42d2c035ad4a56e0c2137cf07ba7ae
SHA1 8002873ab0f454fd262d15092a5b6c0f0cd46f86
SHA512 e56d44c655ac3007cf0630e0dd8a5574afdb49e6aed4f0f386ccdb25244c2730a3df58e62c72298339e5aed9ad37678b68643d02a52dd03ee77ac5cfdfdd6d50
SSDEEP 6144:hzpeart9r5lfpKY25N9a4LsoujLvNpBdS//Tzy/85r9kxOI5AifH2xnTCyCAXwb/:Vpeavr5lfp053cv/AP139Tl0UBi
TLSH
T1D2E46A6A7AA84065D067C17A86938586F7B278550F759BCF03A0936F1F33BE44B3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NexonLauncher64.exe

Path C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
Size 434KB
SHA256 3bc2b9e95b64441b5f1d3704dbc24c5057f368f6a987b3f19c2db6b40ef2667d
MD5 6a3e49a305f343c13d629ad7f5f1486c
SHA1 96485e46a2b9e74639b3b0ba33336a75603ac311
SHA512 931d751554660fd088d56495cb5ab03df8ce0ede4ed0198a5f2bdbbd14a788e723137c445ef7d2e4f14fd5cdb106073b24c6a2f50c57b604d051eeafd4e447fd
SSDEEP 6144:MIiPUKDSp1UMsFhJCaafVJeA9RWF9oZzz0Zh2ohJd5Wu+N1x1f:FiPPSZsFSagVJeCWst7o9ID
TLSH
T14A948E16E6A804F9E0BB91388D535906E7767C4A0370DEEF13A482762F277E05E7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
Size 312B
SHA256 2006c3cf65e4d28d9ee63863bbe36549fda270f77c609a1f405aa40c503741f2
MD5 4972fb31d20a25ce8569b13adee11393
SHA1 f6d5903395033b82cd2a74d00086677955f3540d
SHA512 95a6dde012590b902117aac7fd3b6cf036f2e379affd506cc713f070c1691f6674b6a1fa4155efc993b1a3ce9ee6961dbcde257ff292c111ce10a13bf6b85320
TLSH
T169E07D479162A85D10B1D4E1C8F0CC793920501321C2AC053D3B569CB7B7E69BA5B004
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
Size 400B
SHA256 c3855f49cd618498de59c23798d974742a7d75ff0007c02eb33e51f372f28afd
MD5 4a285a0fa68ed4435435c2f84f30befc
SHA1 bc5e25ba9756a9fcaaf9a0a2c15cc2721de2c11e
SHA512 0d3ce76f4c64f961670ab628bab3a23ac0cc03dbcca3db74b71920121fa39d8b8792d643986daf7ed332242ad9234c56d47f5d27032a7d484031570da8c4ab43
TLSH
T13EE0203037F6052DF5746974C7F546B4455EB1160848C7B51BA004096E57B81EE31D71
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_d65c3cbad0cdc53d7b38e259d352892c_cobalt-strike_elex_icedid_luca-stealer_neshta_njrat_ransomhub_stealc_vidar.exe
Size 383KB
SHA256 efcab4bbe63b79d757f667aa48e3338e98518f16186bf211a1102aad9ff94e2c
MD5 4cb97c2f8368fd28a8bb40a536e7c3fb
SHA1 7edd310f83345d6803c01580dc3bfe6449b632a7
SHA512 c181ea940c03d65cf85d0526b290baa74d4ab598a9844f5c1064bf3f8e1661518b0bcead0077cc06aba88f74a0b8daf68d0036f81e0dff81ddefc6e35dba583c
SSDEEP 6144:lIGC1ZTYnQRtqiSG4jwzjI1G9dpjPMRZf4A1eOJrYhIjJ041R1y:loZTFRtqiSG4jwzcovrM4qeOJrYelI
TLSH
T12F849E41F6A404F6D5B75139C8964A06E772BCAA03B0DBCB23A497662F333D11E3D7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5023.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
Size 8B
SHA256 eb3ecf45e936aca1f9108a22bc1ad1857f8771d590400a0ea139546096ec8ade
MD5 a716f0e3d5e2716757fe922c9d2c7af1
SHA1 3345c58167d2850f63089439b39ea8189aea18dd
SHA512 fa868bdb3c274ea7b894986fd9c0b80e88bcca4538a4b017afec2b47922ee3a099d2d1358d9cb38825ae4ae3e0d6c8581462cb7900eb27afc078dea9184835fc
MD5 SHA1 SHA512

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 699c17dbe6f62c53f7ba614abb7826da1b0190662eef062e5f51bff52264da4c
MD5 a8f854ffb5edfab54aae2353814de82b
SHA1 5ae6396ff17760043b224e5276c0be9e97d417a6
SHA512 447029627510ff74f622baecf1317b9a6a2b99d358a627f3574fbf8985975b44ee0b46c33c0c0b3afe441f37649045c530a54b0d9d3c40b42eda849ed79079ec
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
TLSH
T143130861FB90C472C4209ABCCE1593F4D43B7F21E96919A3E5AD7CE8B9397B11A0807D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3284-181-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3284-179-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3284-140-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3284-139-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4304-182-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4304-226-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads