Overview

overview

6

Static

static

1

2026-08-10...ar.exe

windows10-2004-x64

6

2026-08-10...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
  • Size 385KB
  • Sample260810-e5dy6sbj4z
  • SHA256 f1fee86ee3107f2a1d35f2e013fc7243acd908ac160c811441c6f88342aa85da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarespyware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe" -08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      PID:4156
  • C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
    C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies data under HKEY_USERS
    PID:6484

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CrashReporter_64.dll
        • Path C:\ProgramData\Nexon\NGM\CrashReporter_64.dll
        • Size 1.4MB
        • SHA256 3f676a3df1267fc6e7b84f8ca39f4ff04f5cacb849f48dbb58d481a608f7ae11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGM64.exe
        • Path C:\ProgramData\Nexon\NGM\NGM64.exe
        • Size 385KB
        • SHA256 f1fee86ee3107f2a1d35f2e013fc7243acd908ac160c811441c6f88342aa85da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGMDll64.dll
        • Path C:\ProgramData\Nexon\NGM\NGMDll64.dll
        • Size 7.6MB
        • SHA256 afb5d81748e19965c6f53f7b7f8a28e5b99b0234f26b490d610baac8baf36d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NGMResource.dll
        • Path C:\ProgramData\Nexon\NGM\NGMResource.dll
        • Size 1.3MB
        • SHA256 7af469571824aed5e6686ec6c421c15f0597a6cf87bc74d9d650cb541a2e0a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebView2Loader.dll
        • Path C:\ProgramData\Nexon\NGM\WebView2Loader.dll
        • Size 158KB
        • SHA256 28b898e4433291c969cd4f3bc46377b195527ad9138df2fa57243ceb6717a6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nugu64.dll
        • Path C:\ProgramData\Nexon\NGM\nugu64.dll
        • Size 2.7MB
        • SHA256 abd1766290a755d0f8d0eabab7967de07d920f53d4034fab77586dc6b8ba4239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrashReporter.dll
        • Path C:\ProgramData\Nexon\NexonLauncher\x64\CrashReporter.dll
        • Size 696KB
        • SHA256 649ac7107e3efca55b69208a32d97dee64285b2b6f2f1e99cdc0e45a8bc3f501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NexonLauncher64.exe
        • Path C:\ProgramData\Nexon\NexonLauncher\x64\NexonLauncher64.exe
        • Size 434KB
        • SHA256 3bc2b9e95b64441b5f1d3704dbc24c5057f368f6a987b3f19c2db6b40ef2667d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
        • Size 313B
        • SHA256 58e7e69ac912179599cc5e5c2b3acbe7239b96bff5724435a5adf778f54792c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
        • Size 400B
        • SHA256 94c33dce6bbe294de4b200e52d601a16d059c37b31e6f1b696f9356c8e21aa56
        • MD5 SHA1 SHA512 TLSH
        Submit Download